CVE-2023-24477

HighCVSS 7.0/10Last modified Nov 10, 2026

Description

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published
Aug 9, 2023
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-244785.5Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux beCVE-2023-244799.8An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108. A specially crafted networkCVE-2023-24485.3The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_teCVE-2023-244807.5Controller DoS due to stack overflow when decoding a message from the server.  See Honeywell Security Notification for recommendations on uCVE-2023-244816.3Improper access control in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user to potentCVE-2023-244829.8A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versiCVE-2023-244837.8A vulnerability has been identified that, if exploited, could result in a local user elevating their privilege level to NT AUTHORITY\SYSTEM CVE-2023-244845.5A malicious user can cause log files to be written to a directory that they do not have permission to write to.CVE-2023-244857.8Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer runniCVE-2023-244865.5A vulnerability has been identified in Citrix Workspace app for Linux that, if exploited, may result in a malicious local user being able toCVE-2023-244877.5Arbitrary file read in Citrix ADC and Citrix GatewayCVE-2023-244886.1Cross site scripting vulnerability in Citrix ADC and Citrix Gateway  in allows and attacker to perform cross site scripting