CVE-2022-31677
published 2022-08-29CVE-2022-31677: An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.38%
30.3th percentile
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | pinniped | >= 0.3.0 < 0.19.0 | 0.19.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev
osv·2024-08-21
CVE-2022-31677 Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev
Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev
Pinniped Supervisor Insufficient Session Expiration vulnerability in go.pinniped.dev
OSV
Pinniped Supervisor Insufficient Session Expiration vulnerability
osv·2022-09-01
CVE-2022-31677 [MEDIUM] Pinniped Supervisor Insufficient Session Expiration vulnerability
Pinniped Supervisor Insufficient Session Expiration vulnerability
### Impact
A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
Access tokens issued by the Pinniped Supervisor have an intended expiration lifetime of approximately two minutes. The Pinniped CLI will automatically use the refresh token, which has a lifetime of approximately nine hours, to request a new access token after the access token's advertised expiration time elapses. Starting in Pinniped version 0.13.0, the Supervisor performs checks during each refresh request against the configured external identity provider to determine if the user should be allowed to continue their
GHSA
Pinniped Supervisor Insufficient Session Expiration vulnerability
ghsa·2022-09-01
CVE-2022-31677 [MEDIUM] CWE-613 Pinniped Supervisor Insufficient Session Expiration vulnerability
Pinniped Supervisor Insufficient Session Expiration vulnerability
### Impact
A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
Access tokens issued by the Pinniped Supervisor have an intended expiration lifetime of approximately two minutes. The Pinniped CLI will automatically use the refresh token, which has a lifetime of approximately nine hours, to request a new access token after the access token's advertised expiration time elapses. Starting in Pinniped version 0.13.0, the Supervisor performs checks during each refresh request against the configured external identity provider to determine if the user should be allowed to continue their
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-29
Published