CVE-2022-30277: bd synapsys Insufficient Session Expiration

Vulnerability summary

CVE-2022-30277 is a medium (CVSS 5.7) Insufficient Session Expiration vulnerability in bd synapsys. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.2% of scored vulnerabilities.

Timeline

1. 01-06-2022
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII).

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."