deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8mp9-w7gr-pvj3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.4.3.5-ga5
Patched in: 7.4.3.5-ga5

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix

Details:
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Fragment Renderer Collection Filter Implementation before v1.0.11 from Liferay Portal (v7.4.3.4) and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.
GitHub Security Advisory: GHSA-8mp9-w7gr-pvj3
Package: com.liferay:com.liferay.fragment.renderer.collection.filter.impl (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.0.11
Patched in: 1.0.11

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the filter_ Prefix

Details:
Multiple cross-site scripting (XSS) vulnerabilities in Liferay Fragment Renderer Collection Filter Implementation before v1.0.11 from Liferay Portal (v7.4.3.4) and Liferay DXP v7.4 GA allows attackers to execute arbitrary web scripts or HTML via parameters with the filter_ prefix.
GitHub Security Advisory: GHSA-7m65-hmvg-rxpc
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.2.0, < 7.2.10.fp15
Patched in: 7.2.10.fp15

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module

Details:
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
GitHub Security Advisory: GHSA-7m65-hmvg-rxpc
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.1.0, < 7.1.10.fp26
Patched in: 7.1.10.fp26

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module

Details:
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
GitHub Security Advisory: GHSA-7m65-hmvg-rxpc
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.0.0, < 7.0.10.fp102
Patched in: 7.0.10.fp102

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module

Details:
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
GitHub Security Advisory: GHSA-7m65-hmvg-rxpc
Package: com.liferay:com.liferay.site.memberships.web (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.10
Patched in: 5.0.10

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS in the Site Module

Details:
Stored cross-site scripting (XSS) vulnerability in the Site module's user membership administration page in Liferay Site Memberships Web before 5.0.10 from Liferay Portal (7.0.1 through 7.4.1), and Liferay DXP 7.0 before fix pack 102, 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the a user's name.
GitHub Security Advisory: GHSA-w397-9p2j-6x23
Package: com.liferay.portal:com.liferay.util.java (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: < 7.9.0
Patched in: 7.9.0

Summary: Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented

Details:
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
GitHub Security Advisory: GHSA-w397-9p2j-6x23
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.2.10.fp5, < 7.2.10.fp14
Patched in: 7.2.10.fp14

Summary: Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented

Details:
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
GitHub Security Advisory: GHSA-w397-9p2j-6x23
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.1.10.fp17, < 7.1.10.fp25
Patched in: 7.1.10.fp25

Summary: Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented

Details:
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
GitHub Security Advisory: GHSA-w397-9p2j-6x23
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.0.10.fp91, < 7.0.10.fp101
Patched in: 7.0.10.fp101

Summary: Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented

Details:
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
GitHub Security Advisory: GHSA-w397-9p2j-6x23
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 7.3.1-ga2, < 7.4.3.4-ga4
Patched in: 7.4.3.4-ga4

Summary: Liferay Portal and Liferay DXP HtmlUtil.escapeRedirect Can Be Circumvented

Details:
HtmlUtil.escapeRedirect in Liferay Portal 7.3.1 through 7.4.2, and Liferay DXP 7.0 fix pack 91 through 101, 7.1 fix pack 17 through 25, 7.2 fix pack 5 through 14, and 7.3 before service pack 3 can be circumvented by using multiple forward slashes, which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, and (3) others parameters that rely on HtmlUtil.escapeRedirect.
GitHub Security Advisory: GHSA-36wv-v2qp-v4g4
Package: org.apache.cxf:cxf-core (MAVEN)
Severity: MODERATE (CVSS 5.6)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 4.1.0, < 4.1.1
Patched in: 4.1.1

Summary: Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

Details:
Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.

Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.
GitHub Security Advisory: GHSA-36wv-v2qp-v4g4
Package: org.apache.cxf:cxf-core (MAVEN)
Severity: MODERATE (CVSS 5.6)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.6.0, < 3.6.6
Patched in: 3.6.6

Summary: Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

Details:
Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.

Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.
GitHub Security Advisory: GHSA-36wv-v2qp-v4g4
Package: org.apache.cxf:cxf-core (MAVEN)
Severity: MODERATE (CVSS 5.6)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 3.5.11
Patched in: 3.5.11

Summary: Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

Details:
Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.

Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.
GitHub Security Advisory: GHSA-r5fj-j449-vqw2
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.4.0, < 7.4.13.u17
Patched in: 7.4.13.u17

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module

Details:
A SQL injection vulnerability in the Fragment module before 4.0.33 from Liferay Portal (7.3.3 through 7.4.3.16), and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
GitHub Security Advisory: GHSA-r5fj-j449-vqw2
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.3.0, < 7.3.10.u4
Patched in: 7.3.10.u4

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module

Details:
A SQL injection vulnerability in the Fragment module before 4.0.33 from Liferay Portal (7.3.3 through 7.4.3.16), and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
GitHub Security Advisory: GHSA-r5fj-j449-vqw2
Package: com.liferay:com.liferay.fragment.service (MAVEN)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 4.0.33
Patched in: 4.0.33

Summary: Liferay Portal and Liferay DXP Vulnerable to SQL Injection via the Fragment Module

Details:
A SQL injection vulnerability in the Fragment module before 4.0.33 from Liferay Portal (7.3.3 through 7.4.3.16), and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
GitHub Security Advisory: GHSA-j5gv-w838-mmcx
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.0, < 7.4.13.u79
Patched in: 7.4.13.u79

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu

Details:
Stored cross-site scripting (XSS) vulnerability in Page Tree menu in Liferay Layout Implementation before 6.0.102 from Liferay Portal (7.3.6 through 7.4.3.78), and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
GitHub Security Advisory: GHSA-j5gv-w838-mmcx
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.3.10.fp1, <= 7.3.10.fp23
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu

Details:
Stored cross-site scripting (XSS) vulnerability in Page Tree menu in Liferay Layout Implementation before 6.0.102 from Liferay Portal (7.3.6 through 7.4.3.78), and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
GitHub Security Advisory: GHSA-j5gv-w838-mmcx
Package: com.liferay:com.liferay.layout.impl (MAVEN)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 6.0.102
Patched in: 6.0.102

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the Page Tree Menu

Details:
Stored cross-site scripting (XSS) vulnerability in Page Tree menu in Liferay Layout Implementation before 6.0.102 from Liferay Portal (7.3.6 through 7.4.3.78), and Liferay DXP 7.3 fix pack 1 through update 23, and 7.4 before update 79 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into page's "Name" text field.
GitHub Security Advisory: GHSA-49gm-5685-8fxv
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 7.4.13.u41, < 7.4.13.u90
Patched in: 7.4.13.u90

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class

Details:
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class before 4.0.51 from Liferay Portal (7.4.3.41 through 7.4.3.89), and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
GitHub Security Advisory: GHSA-49gm-5685-8fxv
Package: com.liferay:com.liferay.oauth2.provider.rest (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0.51
Patched in: 4.0.51

Summary: Liferay Portal and Liferay DXP Vulnerable to XSS via the OAuth2ProviderApplicationRedirect Class

Details:
Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class before 4.0.51 from Liferay Portal (7.4.3.41 through 7.4.3.89), and Liferay DXP 7.4 update 41 through update 89 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter. This issue is caused by an incomplete fix in CVE-2023-33941.
GitHub Security Advisory: GHSA-2ggw-8gmc-r2gq
Package: com.liferay.portal:release.portal.bom (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.1.0-a1
Patched in: 7.1.0-a1

Summary: Liferay Portal XSS vulnerability via movie parameter in the /html/portal/flash.jsp page

Details:
Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter.
GitHub Security Advisory: GHSA-ff6c-w6qf-7xqc
Package: css_parser (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-295: Improper Certificate Validation, CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: < 1.22.0
Patched in: 1.22.0

Summary: CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

Details:
### Summary

The CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with `OpenSSL::SSL::VERIFY_NONE`, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation.

### Details

In `lib/css_parser/parser.rb`, the HTTP client sets:
https://github.com/premailer/css_parser/blob/3f91e8db7547fac50ab50cb7f9920f785f722740/lib/css_parser/parser.rb#L646

```ruby
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
```

As a result, the library does not validate the authenticity of HTTPS connections and does not protect against man-in-the-middle attacks. Any attacker in a position to intercept network traffic can inject or modify CSS loaded via HTTPS URLs without detection or warning.

### PoC

1. Set up a test Ruby project that uses the CSS Parser gem and loads an external stylesheet over HTTPS.
2. Use a local proxy (such as mitmproxy or Burp Suite) to intercept outgoing HTTPS requests.
3. Present a fake self-signed certificate to the client.
4. Inject custom CSS into the intercepted HTTPS response.
   
The request will succeed and the injected CSS will be delivered to the application, as the connection is not validated.

### References
 
https://github.com/premailer/css_parser/issues/185

### Impact

Applications using CSS Parser to load remote stylesheets over HTTPS are vulnerable to CSS injection and content manipulation, regardless of the trust status of the remote server. All users who use CSS Parser to fetch external CSS over HTTPS may be impacted.

### Credit

This vulnerability was uncovered by @JLLeitschuh of the @braze-inc security team.
GitHub Security Advisory: GHSA-ff6c-w6qf-7xqc
Package: css_parser (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-295: Improper Certificate Validation, CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: >= 2.0.0, < 2.1.0
Patched in: 2.1.0

Summary: CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content

Details:
### Summary

The CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with `OpenSSL::SSL::VERIFY_NONE`, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation.

### Details

In `lib/css_parser/parser.rb`, the HTTP client sets:
https://github.com/premailer/css_parser/blob/3f91e8db7547fac50ab50cb7f9920f785f722740/lib/css_parser/parser.rb#L646

```ruby
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
```

As a result, the library does not validate the authenticity of HTTPS connections and does not protect against man-in-the-middle attacks. Any attacker in a position to intercept network traffic can inject or modify CSS loaded via HTTPS URLs without detection or warning.

### PoC

1. Set up a test Ruby project that uses the CSS Parser gem and loads an external stylesheet over HTTPS.
2. Use a local proxy (such as mitmproxy or Burp Suite) to intercept outgoing HTTPS requests.
3. Present a fake self-signed certificate to the client.
4. Inject custom CSS into the intercepted HTTPS response.
   
The request will succeed and the injected CSS will be delivered to the application, as the connection is not validated.

### References
 
https://github.com/premailer/css_parser/issues/185

### Impact

Applications using CSS Parser to load remote stylesheets over HTTPS are vulnerable to CSS injection and content manipulation, regardless of the trust status of the remote server. All users who use CSS Parser to fetch external CSS over HTTPS may be impacted.

### Credit

This vulnerability was uncovered by @JLLeitschuh of the @braze-inc security team.
GitHub Security Advisory: GHSA-4cx3-3c38-j9vv
Package: katalyst-koi (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: >= 5.0.0, < 5.6.0
Patched in: 5.6.0

Summary: katalyst-koi: Session cookies can be replayed after user logout

Details:
### Impact

Admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated.

This affects applications using Koi admin authentication where an admin session cookie may have been exposed, cached, intercepted, or otherwise retained after logout.

### Patches

The issue has been patched by recording admin logout time and rejecting any admin session cookie created before the user’s most recent logout.

Users should upgrade to the patched Koi releases once available.

### Workarounds

Katalyst Koi recommends upgrading to the latest available version, or back porting the changes released in 5.6.0/4.20.0

### Resources

This is an application of https://guides.rubyonrails.org/v5.2.0/security.html#replay-attacks-for-cookiestore-sessions