CVE-2018-1127: red hat red hat gluster storage Insufficient Session Expiration

Vulnerability summary

CVE-2018-1127 is a high (CVSS 8.1) Insufficient Session Expiration vulnerability in red hat red hat gluster storage. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.2% of scored vulnerabilities.

Timeline

1. 11-09-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.