CVE-2024-55603
- Source
- https://cve.org/CVERecord?id=CVE-2024-55603
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-55603.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-55603
- Aliases
-
- GHSA-gv5c-8pxr-p484
- Downstream
- Published
- 2024-12-18T23:52:57.327Z
- Modified
- 2026-08-07T11:49:27.878540492Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Insufficient session invalidation in Kanboard
- Details
-
Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (
app/Core/Session/SessionHandler.php), to store the session data in a database. Therefore, when asession_idis given, kanboard queries the data from thesessionssql table. At this point, it does not correctly verify, if a givensession_idhas already exceeded its lifetime (expires_at). Thus, a session which's lifetime is already> time(), is still queried from the database and hence a valid login. The implemented SessionHandlerInterface::gc function, that does remove invalid sessions, is called only with a certain probability (Cleans up expired sessions. Called bysession_start(), based onsession.gc_divisor,session.gc_probabilityandsession.gc_maxlifetimesettings) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gcprobability=1, session.gcdivisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability. - Database specific
{ "unresolved_ranges": [ { "extracted_events": [ { "fixed": "1.2.43" } ], "source": "AFFECTED_FIELD" } ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55603.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-613" ] }- References
-
- https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40
- https://www.php.net/manual/en/function.session-start.php
- https://www.php.net/manual/en/session.configuration.php#ini.session.gc-divisor
- https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime
- https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probability
- https://www.php.net/manual/en/sessionhandlerinterface.gc.php
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55603.json
- https://github.com/kanboard/kanboard/security/advisories/GHSA-gv5c-8pxr-p484
- https://nvd.nist.gov/vuln/detail/CVE-2024-55603
- https://github.com/kanboard/kanboard/commit/7ce61c34d962ca8b5dce776289ddf4b207be6e78
Affected packages
Git / github.com/kanboard/kanboard
Affected ranges
- Type
- GIT
- Repo
- https://github.com/kanboard/kanboard
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.2.43" } ], "cpe": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ] }