VYPR
← All advisories
Moderate severityNVD Advisory· Published Apr 5, 2023· Updated Feb 10, 2025

Insufficient Session Expiration in firefly-iii/firefly-iii

CVE-2023-1788

Description

Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
grumpydictator/firefly-iiiPackagist
< 6.0.06.0.0

Affected products

1

Patches

1
68f398f97cbe

Merge pull request #7062 from firefly-iii/JC5-patch-1

https://github.com/firefly-iii/firefly-iiiJames ColeFeb 20, 2023via ghsa
commit
1 file changed · +1 −1
  • config/session.php+1 −1 modified
    @@ -24,7 +24,7 @@
 return [
     'driver'          => env('SESSION_DRIVER', 'file'),
     'lifetime'        => 120,
-    'expire_on_close' => false,
+    'expire_on_close' => true,
     'encrypt'         => true,
     'files'           => storage_path('framework/sessions'),
     'connection'      => null,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.