GitHub Advisoryadvisory · npm

GHSA-9j9m-8wjc-ff96 Apostrophe CMS Insufficient Session Expiration vulnerability

CRITICAL Published 2021-11-10 Modified 2022-08-22 Official page ↗
Aliases
CVE-2021-25979
Ecosystem
npm
Packages
apostrophe
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-613
Reviewed
2021-11-09

Affected packages

• npm apostrophe: >= 2.63.0, < 3.4.0 → fixed in 3.4.0

Description

Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2021-25979 Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password,… vulnerability

References