CVE-2022-25590
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
The vulnerability in SurveyKing v0.2.0 retains users' session cookies after logout. An attacker can use the browser cache to log in to the system and access data when the user exits the application.
Risk Assessment
The risk involves unauthorized access to data and the system by an attacker who has physical or remote access to the victim's browser after logout.
Recommendation
Update SurveyKing to the latest version that properly clears session cookies upon logout. As a workaround, manually clear the browser cache after each session.
Original NVD description (English source)
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.