CVE-2023-42446 Pow Mnesia cache doesn't invalidate all expired keys on startup

2023-09-1821:29:22

CWE-298

GitHub_M

www.cve.org

cve pow mnesiacache phoenix plug session hijacking vulnerability workaround invalidation patch.

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

23.9%

JSON

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of Pow.Store.Backend.MnesiaCache is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all Pow.Store.Backend.MnesiaCache instances have been shut down for a period that is longer than a session’s remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.

CNA Affected

[
  {
    "vendor": "pow-auth",
    "product": "pow",
    "versions": [
      {
        "version": ">= 1.0.14, < 1.0.34",
        "status": "affected"
      }
    ]
  }
]