Session Invalidation Vulnerability in Guardian/CMC Versions Before 22.6.2

CVE-2023-24477 · HIGH Severity

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.

Learn more about our Cis Benchmark Audit For Google Chrome.