Lucene search
GitHub_MCVE-2023-49091HistoryNov 29, 2023 - 8:15 p.m.
CVE-2023-49091
2023-11-2920:15:08
CWE-613
GitHub_M
web.nvd.nist.gov
18
cosmos
server
vulnerability
unauthorized access
authorization header
log out
nvd
cve-2023-49091
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.4
Confidence
High
EPSS
0.001
Percentile
43.4%
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an attacker to use the token to gain unauthorized access to the application/system even after the user has logged out. This issue has been patched in version 0.13.0.
Affected configurations
Node
cosmos-cloudcosmos_serverMatch0.1.15
ORcosmos-cloudcosmos_serverMatch0.1.16
ORcosmos-cloudcosmos_serverMatch0.1.17
ORcosmos-cloudcosmos_serverMatch0.2.0
ORcosmos-cloudcosmos_serverMatch0.3.0-
ORcosmos-cloudcosmos_serverMatch0.3.1
ORcosmos-cloudcosmos_serverMatch0.3.2
ORcosmos-cloudcosmos_serverMatch0.3.3
ORcosmos-cloudcosmos_serverMatch0.3.4
ORcosmos-cloudcosmos_serverMatch0.3.5
ORcosmos-cloudcosmos_serverMatch0.4.0-
ORcosmos-cloudcosmos_serverMatch0.4.1
ORcosmos-cloudcosmos_serverMatch0.4.2
ORcosmos-cloudcosmos_serverMatch0.4.3
ORcosmos-cloudcosmos_serverMatch0.5.0-
ORcosmos-cloudcosmos_serverMatch0.5.1
ORcosmos-cloudcosmos_serverMatch0.5.2
ORcosmos-cloudcosmos_serverMatch0.5.3
ORcosmos-cloudcosmos_serverMatch0.5.4
ORcosmos-cloudcosmos_serverMatch0.5.5
ORcosmos-cloudcosmos_serverMatch0.5.6
ORcosmos-cloudcosmos_serverMatch0.5.7-
ORcosmos-cloudcosmos_serverMatch0.5.8
ORcosmos-cloudcosmos_serverMatch0.5.9
ORcosmos-cloudcosmos_serverMatch0.5.12
ORcosmos-cloudcosmos_serverMatch0.6.0-
ORcosmos-cloudcosmos_serverMatch0.6.1
ORcosmos-cloudcosmos_serverMatch0.6.2
ORcosmos-cloudcosmos_serverMatch0.6.3
ORcosmos-cloudcosmos_serverMatch0.6.4-
ORcosmos-cloudcosmos_serverMatch0.7.0-
ORcosmos-cloudcosmos_serverMatch0.7.1
ORcosmos-cloudcosmos_serverMatch0.7.2
ORcosmos-cloudcosmos_serverMatch0.7.3
ORcosmos-cloudcosmos_serverMatch0.7.4
ORcosmos-cloudcosmos_serverMatch0.7.5
ORcosmos-cloudcosmos_serverMatch0.7.6
ORcosmos-cloudcosmos_serverMatch0.7.7
ORcosmos-cloudcosmos_serverMatch0.7.8
ORcosmos-cloudcosmos_serverMatch0.7.9
ORcosmos-cloudcosmos_serverMatch0.7.10
ORcosmos-cloudcosmos_serverMatch0.8.0-
ORcosmos-cloudcosmos_serverMatch0.8.1
ORcosmos-cloudcosmos_serverMatch0.8.2
ORcosmos-cloudcosmos_serverMatch0.8.3
ORcosmos-cloudcosmos_serverMatch0.8.4
ORcosmos-cloudcosmos_serverMatch0.8.5
ORcosmos-cloudcosmos_serverMatch0.8.6
ORcosmos-cloudcosmos_serverMatch0.8.7
ORcosmos-cloudcosmos_serverMatch0.8.8
ORcosmos-cloudcosmos_serverMatch0.8.9
ORcosmos-cloudcosmos_serverMatch0.8.10
ORcosmos-cloudcosmos_serverMatch0.8.11
ORcosmos-cloudcosmos_serverMatch0.9.0-
ORcosmos-cloudcosmos_serverMatch0.9.1
ORcosmos-cloudcosmos_serverMatch0.9.2
ORcosmos-cloudcosmos_serverMatch0.9.3
ORcosmos-cloudcosmos_serverMatch0.9.4
ORcosmos-cloudcosmos_serverMatch0.9.5
ORcosmos-cloudcosmos_serverMatch0.9.6
ORcosmos-cloudcosmos_serverMatch0.9.7
ORcosmos-cloudcosmos_serverMatch0.9.8
ORcosmos-cloudcosmos_serverMatch0.9.9
ORcosmos-cloudcosmos_serverMatch0.9.10
ORcosmos-cloudcosmos_serverMatch0.9.11
ORcosmos-cloudcosmos_serverMatch0.9.12
ORcosmos-cloudcosmos_serverMatch0.9.13
ORcosmos-cloudcosmos_serverMatch0.9.14
ORcosmos-cloudcosmos_serverMatch0.9.15
ORcosmos-cloudcosmos_serverMatch0.9.16
ORcosmos-cloudcosmos_serverMatch0.9.17
ORcosmos-cloudcosmos_serverMatch0.9.18
ORcosmos-cloudcosmos_serverMatch0.9.19-
ORcosmos-cloudcosmos_serverMatch0.9.20
ORcosmos-cloudcosmos_serverMatch0.9.21
ORcosmos-cloudcosmos_serverMatch0.10.0-
ORcosmos-cloudcosmos_serverMatch0.10.1-
ORcosmos-cloudcosmos_serverMatch0.10.2
ORcosmos-cloudcosmos_serverMatch0.10.3
ORcosmos-cloudcosmos_serverMatch0.10.4-
ORcosmos-cloudcosmos_serverMatch0.11.0-
ORcosmos-cloudcosmos_serverMatch0.11.1
ORcosmos-cloudcosmos_serverMatch0.11.2
ORcosmos-cloudcosmos_serverMatch0.11.3
ORcosmos-cloudcosmos_serverMatch0.12.0-
ORcosmos-cloudcosmos_serverMatch0.12.1
ORcosmos-cloudcosmos_serverMatch0.12.2
ORcosmos-cloudcosmos_serverMatch0.12.3
ORcosmos-cloudcosmos_serverMatch0.12.4
ORcosmos-cloudcosmos_serverMatch0.12.5
ORcosmos-cloudcosmos_serverMatch0.12.6-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| cosmos-cloud | cosmos_server | 0.1.15 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.15:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.1.16 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.16:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.1.17 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.1.17:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.2.0 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.2.0:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.3.0 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.0:-:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.3.1 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.1:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.3.2 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.2:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.3.3 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.3:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.3.4 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.4:*:*:*:*:*:*:* |
| cosmos-cloud | cosmos_server | 0.3.5 | cpe:2.3:a:cosmos-cloud:cosmos_server:0.3.5:*:*:*:*:*:*:* |
CNA Affected
[
{
"vendor": "azukaar",
"product": "Cosmos-Server",
"versions": [
{
"version": "< 0.13.0",
"status": "affected"
}
]
}
]Related
cvelist
cvelist
osv
osv
CVE-2023-49091
2023-11-29 20:15:08
veracode
veracode
Insufficient Session Expiration
2023-11-30 08:41:42
prion
prion
Authorization
2023-11-29 20:15:00
nvd
nvd
CVE-2023-49091
2023-11-29 20:15:08
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
9.4
Confidence
High
EPSS
0.001
Percentile
43.4%
Related for CVE-2023-49091