CVEvulnerability
CVE-2021-25981
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-01-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-613
Description
In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)
Affected configurations
• talkyard talkyard (>= 0.2021.20 < 0.2021.35)
Related
Weakness · not in database (1)
References
- https://github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34 Patch, Third Party Advisory
- https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761 Patch, Third Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981 Patch, Third Party Advisory, VDB Entry
- https://github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34 Patch, Third Party Advisory
- https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761 Patch, Third Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981 Patch, Third Party Advisory, VDB Entry