Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreshRSS has Incomplete Session Termination on Logout
Vulnerability Description
FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a user logs out, the session cookie remains active and unchanged. The unchanged cookie could be reused by an attacker if a new session were to be started. This failure to invalidate the session can lead to session hijacking and fixation vulnerabilities. This issue is fixed in version 1.27.0
CVSS Information
N/A
Vulnerability Type
不充分的会话过期机制
Vulnerability Title
FreshRSS 代码问题漏洞
Vulnerability Description
FreshRSS是FreshRSS开源的一个免费的、可自行托管的 RSS 聚合器。 FreshRSS 1.26.3及之前版本存在代码问题漏洞，该漏洞源于注销时未正确终止会话，可能导致会话劫持和固定漏洞。
CVSS Information
N/A
Vulnerability Type
N/A