CVE-2022-1955

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	Session	1.13.0

References

https://fluidattacks.com/advisories/tempest/Exploit, Issue Tracking, Third Party Advisory
https://github.com/oxen-io/session-androidProduct, Third Party Advisory
https://github.com/oxen-io/session-android/pull/897Exploit, Issue Tracking, Third Party Advisory
https://fluidattacks.com/advisories/tempest/Exploit, Issue Tracking, Third Party Advisory
https://github.com/oxen-io/session-androidProduct, Third Party Advisory
https://github.com/oxen-io/session-android/pull/897Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19564.3The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which coul CVE-2022-19574.3The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-19586.5A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manip CVE-2022-19596.6AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because th CVE-2022-19604.3The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l CVE-2022-19614.8The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4 CVE-2022-19625.5Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack e CVE-2022-19635.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 befor CVE-2022-19645.4The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Autho CVE-2022-19658.1Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly CVE-2022-19676.5The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perfo CVE-2022-19687.8Use After Free in GitHub repository vim/vim prior to 8.2.