{"id":"CVE-2022-1155","published":"2022-03-30T12:20:14Z","modified":"2024-08-02T23:55:24Z","title":"Old sessions are not blocked by the login enable function. in snipe/snipe-it","vendor":"snipe","product":"snipe/snipe-it","tier":"tail","description":{"text":"Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.4,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00992,"percentile":0.62584,"provenance":"source"},"cwes":[{"id":"CWE-840","name":"Business Logic Errors"}],"references":[{"url":"https://huntr.dev/bounties/ebc26354-2414-4f72-88aa-f044aec2b2e1","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/snipe/snipe-it/commit/bdabbbd4e98e88ee01e728ceb4fd512661fbd38d","tags":["x_refsource_MISC"]}],"priority":{"score":17.7,"factors":[{"name":"EPSS percentile","points":12.52},{"name":"CVSS severity","points":5.18}]},"vendorSlug":"snipe","affectedVersions":[{"vendor":"snipe","product":"snipe/snipe-it","versions":[">= unspecified, < 5.3.10"]}],"affected":[{"ecosystem":"Packagist","package":"snipe/snipe-it","vulnerableRanges":[">=6.0.0-RC-1, <6.0.0-RC-6","<5.4.2"],"patched":["6.0.0-RC-6","5.4.2"],"from":["GHSA-636j-7x7r-gvw2"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1334","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-3938","published":"2021-11-13","fixed":"5.4.0","kev":false,"link":{"from":"CVE-2021-3938","to":"CVE-2022-1155","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:snipe/snipe-it","fromFixed":"5.4.0","toFixed":"5.4.2","daysApart":137}]}},{"cve":"CVE-2022-1380","published":"2022-04-16","fixed":"5.4.3","kev":false,"link":{"from":"CVE-2022-1155","to":"CVE-2022-1380","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:snipe/snipe-it","fromFixed":"5.4.2","toFixed":"5.4.3","daysApart":17}]}},{"cve":"CVE-2022-1445","published":"2022-04-24","fixed":"5.4.3","kev":false,"link":{"from":"CVE-2022-1155","to":"CVE-2022-1445","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:snipe/snipe-it","fromFixed":"5.4.2","toFixed":"5.4.3","daysApart":25}]}},{"cve":"CVE-2022-1511","published":"2022-04-28","fixed":"5.4.4","kev":false},{"cve":"CVE-2022-1155","published":"2022-03-30","fixed":"6.0.0-RC-6","kev":false},{"cve":"CVE-2021-4075","published":"2021-12-06","fixed":"6.0.0-GM","kev":false},{"cve":"CVE-2022-2997","published":"2022-08-25","fixed":"6.0.10","kev":false},{"cve":"CVE-2022-3173","published":"2022-09-17","fixed":"6.0.10","kev":false}],"package":"Packagist:snipe/snipe-it"}}