{"id":"CVE-2022-2713","aliases":["EUVD-2022-6633","GHSA-vm6p-35rw-3fxc"],"status":"published","title":"Insufficient Session Expiration in cockpit-hq/cockpit","description":"Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.","severity":{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01252,"percentile":0.69643,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-613"],"published":"2022-08-08T14:30:13Z","modified":"2026-10-28T02:30:25Z","fixes":[{"ecosystem":"Packagist","package":"aheinze/cockpit","fixed_in":["2.2.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"aheinze/cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"aheinze/cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.11.0","0.11.1","0.11.2","0.12.0","0.12.1","0.12.2","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.10","0.8.11","0.8.2","0.8.3","0.8.4","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3"]}],"products":[{"vendor":"agentejo","product":"cockpit"},{"vendor":"cockpit-hq","product":"cockpit-hq/cockpit"}],"references":[{"url":"https://huntr.dev/bounties/3080fc96-75d7-4868-84de-9fc8c9b90290","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://github.com/cockpit-hq/cockpit/commit/dd8d0314912fa6517ebd2cc9939d9fafbe68731b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2713","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vm6p-35rw-3fxc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2713.json","tags":["advisory"]},{"url":"https://github.com/cockpit-hq/cockpit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-2713","title":"Insufficient Session Expiration in cockpit-hq/cockpit","description":"Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.","status":"published","published":"2022-08-08T14:30:13Z","modified":"2026-03-27T19:44:14.574Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-6633","description":"Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.","status":"published","published":"2022-08-08T14:30:13Z","modified":"2026-03-27T19:44:14Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:25:27.277964Z"}],"ghsa":[{"id":"GHSA-vm6p-35rw-3fxc","title":"Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration","description":"Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.","status":"published","published":"2022-08-09T00:00:25Z","modified":"2023-01-30T05:06:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-2713","description":"Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.","status":"published","published":"2022-08-08T15:15:08.777Z","modified":"2026-06-17T04:42:26.207Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:07:24.39467Z"}],"osv":[{"id":"CVE-2022-2713","title":"Insufficient Session Expiration in cockpit-hq/cockpit","description":"Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.","status":"published","published":"2022-08-08T14:30:13Z","modified":"2026-10-28T02:30:25.481360892Z","cvss":[{"version":"3.0","score":8.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"GHSA-vm6p-35rw-3fxc","title":"Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration","description":"Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.","status":"published","published":"2022-08-09T00:00:25Z","modified":"2023-11-08T04:08:56.146982Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}