Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.9
CVE-2022-3362: rdiffweb may keep user sessions active after logout
CVE-2022-3362 · published 3 years ago
Summary
rdiffweb versions before 2.5.0 do not end a user's session promptly when they log out or become inactive. This could let anyone who gains access to the same browser continue using the account. Update rdiffweb to version 2.5.0 or later and set shorter session timeouts.
What to do
- Update patrik dufresne rdiffweb to version 2.5.0.
- Update ikus-soft rdiffweb to version 2.5.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | patrik dufresne | rdiffweb |
< 2.5.0 Fix: upgrade to 2.5.0
|
| – | ikus-soft | rdiffweb |
< 2.5.0 cpe:2.3:a:ikus-soft:rdiffweb:*:*:*:*:*:*:*:* |
Original advisory text
Insufficient Session Expiration in ikus060/rdiffweb
Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
References
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-43...
- https://github.com/advisories/GHSA-94qm-99qc-qwqj
- https://huntr.dev/bounties/ca428c31-858d-47fa-adc9-2a59f8e8b2b1 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3362.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-3362 Vendor Advisory
- https://github.com/ikus060/rdiffweb/commit/6efb995bc32c8a8e9ad755eb813dec991dffb... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-613Insufficient Session Expiration
Timeline
Published14 Nov 2022
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta