Vulnerability	Vulnerable Version
C Insufficient Session Expiration Affected versions of this package are vulnerable to Insufficient Session Expiration in the `AuthorizationFilter` of the REST service, which caches authenticated users in a `UserCache` keyed by the Basic Authorization header and never expires or revalidates the entries. An attacker can gain authenticated access to the REST interface by replaying a captured Basic Authorization header whose credentials have since been changed or revoked, which the cache still resolves to a valid user without rechecking the credentials. Exploitation requires the REST interface to be enabled and the attacker to possess a Basic Authorization header value that was valid before its underlying credentials were rotated or revoked. How to fix Insufficient Session Expiration? Upgrade `org.apache.iotdb:rest` to version 2.0.10 or higher.	[1.0.0,2.0.10)

Insufficient Session Expiration

Affected versions of this package are vulnerable to Insufficient Session Expiration in the AuthorizationFilter of the REST service, which caches authenticated users in a UserCache keyed by the Basic Authorization header and never expires or revalidates the entries. An attacker can gain authenticated access to the REST interface by replaying a captured Basic Authorization header whose credentials have since been changed or revoked, which the cache still resolves to a valid user without rechecking the credentials. Exploitation requires the REST interface to be enabled and the attacker to possess a Basic Authorization header value that was valid before its underlying credentials were rotated or revoked.

How to fix Insufficient Session Expiration?

Upgrade org.apache.iotdb:rest to version 2.0.10 or higher.

[1.0.0,2.0.10)

Go back to all versions of this package