← Back

CVE-2024-7998

nvd nist
Published: Aug 21, 2024Modified: Jun 17, 2026

JSON object

Loading...
2.6
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N
Exploitability: 1.0 / Impact: 1.4
Source: security@octopus.com (Secondary)

Description

In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespan.

Affected (2)

Octopus
1 product
Octopus Server
Configuration A
2 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Octopus
Octopus Server
From 2022.4.8332 to 2024.1.12931
Octopus Server
From 2024.2.101 to 2024.2.9313
Running on/withPlatform Versions
Linux
Linux Kernel
All versions
Microsoft
Windows
All versions

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

Source: security@octopus.com
Vendor Advisory

Timeline

No history available yet.