Common Weakness Enumeration

CWE-613

Allowed-with-Review

Insufficient Session Expiration

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

1091 vulnerabilities reference this CWE, most recent first.

GHSA-4H3P-63X6-VWG2

Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2025-02-10 20:57
VLAI
Summary
Magento Insufficient Session Expiration
Details

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Severity
5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.1-p1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/project-community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21031"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-10T18:21:01Z",
    "nvd_published_at": "2021-02-11T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.",
  "id": "GHSA-4h3p-63x6-vwg2",
  "modified": "2025-02-10T20:57:37Z",
  "published": "2022-05-24T17:41:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21031"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/magento/magento2"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Magento Insufficient Session Expiration"
}

GHSA-4H9Q-HVW7-G725

Vulnerability from github – Published: 2022-05-17 00:24 – Updated: 2022-05-17 00:24
VLAI
Details

Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a password change.

Severity
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-1000136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-03T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a password change.",
  "id": "GHSA-4h9q-hvw7-g725",
  "modified": "2022-05-17T00:24:06Z",
  "published": "2022-05-17T00:24:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000136"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/mahara/+bug/1363873"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4HV6-XC92-J86G

Vulnerability from github – Published: 2026-10-09 20:57 – Updated: 2026-10-09 20:57
VLAI
Summary
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Details

Summary

Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/{id} documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically valid user JWT without ever resolving its sid (session id) claim against the sessions table. A connection authenticated before revocation stays authenticated and continues to receive live pushes indefinitely, and even brand-new WebSocket connections are accepted with a token whose session was deleted. The revocation feature therefore does not cover the WebSocket boundary at all.

Details

User access JWTs carry a session reference: NewUserJWTAuthtoken (pkg/modules/auth/auth.go:188) sets claims["sid"] = sessionID, and the API login-session documentation describes the claim as tying the JWT to a server-side session. On the HTTP side nothing consumes the claim per request either (REST access tokens simply expire after their short TTL, a design the maintainers documented when fixing GHSA-96q5, and refresh tokens are correctly invalidated when the session row is deleted).

The WebSocket endpoint GET /api/v2/ws authenticates through the first client message. Connection.handleAuth (pkg/websocket/connection.go:168) validates the token exclusively with auth.GetUserIDFromToken (pkg/modules/auth/auth.go:292):

func GetUserIDFromToken(tokenString string) (int64, error) {
    token, err := jwt.Parse(tokenString, func(_ *jwt.Token) (any, error) {
        return []byte(config.ServiceSecret.GetString()), nil
    })
    ...
    typ, ok := claims["type"].(float64)
    if !ok || int(typ) != AuthTypeUser {
        return 0, jwt.ErrTokenInvalidClaims
    }
    ...
}

The function verifies signature and token type only. No session lookup occurs anywhere in the WebSocket path, and no re-validation happens after the initial auth. Consequently:

  1. A connection authenticated before DELETE /api/v2/user/sessions/{id} (or before TOTP enable, which runs models.DeleteAllUserSessions, pkg/routes/api/v2/user_totp.go:208) remains registered in the hub and keeps receiving every subscribed event, such as notification.created with the full notification object including comment, task and project content.
  2. A new connection opened after the deletion, using the same pre-revocation token, authenticates successfully.
  3. Session deletion is observable only in the REST surface. The user's session list empties, the refresh token dies on next use, but the WebSocket channel never notices.

For REST the exposure is bounded by the 10-minute access-token TTL. For WebSocket it is not: a connection lives until the client closes it, so a session the user believes revoked retains a live, server-pushed data channel with no time bound.

PoC

vikunja-ws-auth-ignores-session-revocation-PoC.zip

The attached archive contains deployment/deploy.sh (local Vikunja v2.6.0 on loopback with SQLite) and poc/poc.sh running poc/poc.py:

  1. Victim registers and logs in. Second user registers for later interaction.
  2. Control: the victim's WebSocket authenticates and subscribes to notification.created. Negative control: a garbage token is rejected with invalid_token.
  3. Every victim session is deleted via DELETE /api/v2/user/sessions/{id} (the list afterwards reports 0 remaining).
  4. Exploit A: a brand-new WebSocket connection authenticates successfully with the deleted-session token.
  5. Exploit B: the second user comments on a task mentioning the victim. The victim's pre-revocation WebSocket connection receives the notification.created push with the full notification payload.

Result: 10 checks passed on two consecutive runs, each from a wiped database.

Impact

Session revocation, the mechanism a user relies on when a device is lost or a token is suspected stolen, silently excludes the WebSocket channel. A stolen or leaked access token can be converted into a push channel that survives every revocation action available to the user, including TOTP enrollment whose documented purpose is invalidating all sessions, and keeps delivering the victim's notifications (comment mentions, task and project metadata) until the attacker chooses to disconnect. The fix is to resolve the sid claim against the sessions table during handleAuth and to re-validate or drop hub connections when their session is deleted.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.vikunja.io/api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "last_affected": "2.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T20:57:34Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nVikunja v2.6.0 introduced server-side sessions with revocation semantics: `DELETE /api/v2/user/sessions/{id}` documents \"Revokes a specific session by its UUID\", and enabling TOTP calls `DeleteAllUserSessions` to invalidate all sessions. The WebSocket endpoint accepts any cryptographically valid user JWT without ever resolving its `sid` (session id) claim against the sessions table. A connection authenticated before revocation stays authenticated and continues to receive live pushes indefinitely, and even brand-new WebSocket connections are accepted with a token whose session was deleted. The revocation feature therefore does not cover the WebSocket boundary at all.\n\n### Details\n\nUser access JWTs carry a session reference: `NewUserJWTAuthtoken` (`pkg/modules/auth/auth.go:188`) sets `claims[\"sid\"] = sessionID`, and the API login-session documentation describes the claim as tying the JWT to a server-side session. On the HTTP side nothing consumes the claim per request either (REST access tokens simply expire after their short TTL, a design the maintainers documented when fixing GHSA-96q5, and refresh tokens are correctly invalidated when the session row is deleted).\n\nThe WebSocket endpoint `GET /api/v2/ws` authenticates through the first client message. `Connection.handleAuth` (`pkg/websocket/connection.go:168`) validates the token exclusively with `auth.GetUserIDFromToken` (`pkg/modules/auth/auth.go:292`):\n\n```go\nfunc GetUserIDFromToken(tokenString string) (int64, error) {\n\ttoken, err := jwt.Parse(tokenString, func(_ *jwt.Token) (any, error) {\n\t\treturn []byte(config.ServiceSecret.GetString()), nil\n\t})\n\t...\n\ttyp, ok := claims[\"type\"].(float64)\n\tif !ok || int(typ) != AuthTypeUser {\n\t\treturn 0, jwt.ErrTokenInvalidClaims\n\t}\n\t...\n}\n```\n\nThe function verifies signature and token type only. No session lookup occurs anywhere in the WebSocket path, and no re-validation happens after the initial auth. Consequently:\n\n1. A connection authenticated before `DELETE /api/v2/user/sessions/{id}` (or before TOTP enable, which runs `models.DeleteAllUserSessions`, `pkg/routes/api/v2/user_totp.go:208`) remains registered in the hub and keeps receiving every subscribed event, such as `notification.created` with the full notification object including comment, task and project content.\n2. A new connection opened after the deletion, using the same pre-revocation token, authenticates successfully.\n3. Session deletion is observable only in the REST surface. The user\u0027s session list empties, the refresh token dies on next use, but the WebSocket channel never notices.\n\nFor REST the exposure is bounded by the 10-minute access-token TTL. For WebSocket it is not: a connection lives until the client closes it, so a session the user believes revoked retains a live, server-pushed data channel with no time bound.\n\n### PoC\n\n\u003e [vikunja-ws-auth-ignores-session-revocation-PoC.zip](https://github.com/user-attachments/files/32741065/vikunja-ws-auth-ignores-session-revocation-PoC.zip)\n\nThe attached archive contains `deployment/deploy.sh` (local Vikunja v2.6.0 on loopback with SQLite) and `poc/poc.sh` running `poc/poc.py`:\n\n1. Victim registers and logs in. Second user registers for later interaction.\n2. Control: the victim\u0027s WebSocket authenticates and subscribes to `notification.created`. Negative control: a garbage token is rejected with `invalid_token`.\n3. Every victim session is deleted via `DELETE /api/v2/user/sessions/{id}` (the list afterwards reports 0 remaining).\n4. Exploit A: a brand-new WebSocket connection authenticates successfully with the deleted-session token.\n5. Exploit B: the second user comments on a task mentioning the victim. The victim\u0027s pre-revocation WebSocket connection receives the `notification.created` push with the full notification payload.\n\nResult: 10 checks passed on two consecutive runs, each from a wiped database.\n\n### Impact\n\nSession revocation, the mechanism a user relies on when a device is lost or a token is suspected stolen, silently excludes the WebSocket channel. A stolen or leaked access token can be converted into a push channel that survives every revocation action available to the user, including TOTP enrollment whose documented purpose is invalidating all sessions, and keeps delivering the victim\u0027s notifications (comment mentions, task and project metadata) until the attacker chooses to disconnect. The fix is to resolve the `sid` claim against the sessions table during `handleAuth` and to re-validate or drop hub connections when their session is deleted.",
  "id": "GHSA-4hv6-xc92-j86g",
  "modified": "2026-10-09T20:57:35Z",
  "published": "2026-10-09T20:57:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4hv6-xc92-j86g"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vikunja/vikunja"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes"
}

GHSA-4HWW-MCVX-H475

Vulnerability from github – Published: 2024-03-28 21:30 – Updated: 2024-03-28 21:30
VLAI
Details

Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-25954"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-28T19:15:47Z",
    "severity": "MODERATE"
  },
  "details": "Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.",
  "id": "GHSA-4hww-mcvx-h475",
  "modified": "2024-03-28T21:30:31Z",
  "published": "2024-03-28T21:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25954"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4J27-QHM5-88W7

Vulnerability from github – Published: 2024-05-06 18:30 – Updated: 2025-03-18 15:30
VLAI
Details

An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0.3) is also a fixed release.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-34092"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-06T16:15:13Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0.3) is also a fixed release.",
  "id": "GHSA-4j27-qhm5-88w7",
  "modified": "2025-03-18T15:30:38Z",
  "published": "2024-05-06T18:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34092"
    },
    {
      "type": "WEB",
      "url": "https://archerirm.com"
    },
    {
      "type": "WEB",
      "url": "https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/720963"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4JFQ-F8HC-775Q

Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2025-02-10 20:56
VLAI
Summary
Magento Insufficient Session Expiration
Details

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Severity
5.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.1-p1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/project-community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-10T18:20:45Z",
    "nvd_published_at": "2021-02-11T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.",
  "id": "GHSA-4jfq-f8hc-775q",
  "modified": "2025-02-10T20:56:17Z",
  "published": "2022-05-24T17:41:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21032"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/magento/magento2"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Magento Insufficient Session Expiration"
}

GHSA-4JG6-VWW8-2XF3

Vulnerability from github – Published: 2026-09-29 00:31 – Updated: 2026-09-29 00:31
VLAI
Details

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-102367"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T00:17:04Z",
    "severity": "MODERATE"
  },
  "details": "mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access that account disabling was intended to remove.",
  "id": "GHSA-4jg6-vww8-2xf3",
  "modified": "2026-09-29T00:31:40Z",
  "published": "2026-09-29T00:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102367"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/T02_refresh_token_enabled_bypass.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gz-yami/mall4j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/controller/TokenController.java#L38-L44"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-security/yami-shop-security-common/src/main/java/com/yami/shop/security/common/manager/TokenStore.java#L121-L130"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-insufficient-session-expiration-via-token-refresh"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-4JVX-6G9P-MGXW

Vulnerability from github – Published: 2022-05-13 01:30 – Updated: 2022-05-13 01:30
VLAI
Details

A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability exists because the affected software does not reset the privilege level for each web UI session. An attacker who has valid credentials for an affected device could exploit this vulnerability by remotely accessing a VTY line to the device. A successful exploit could allow the attacker to access an affected device with the privileges of the user who previously logged in to the web UI. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled and authentication, authorization, and accounting (AAA) authorization is not configured for EXEC sessions. The default state of the HTTP Server feature is version-dependent. This vulnerability was introduced in Cisco IOS XE Software Release 16.1.1. Cisco Bug IDs: CSCvf71769.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-0152"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-28T22:29:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability exists because the affected software does not reset the privilege level for each web UI session. An attacker who has valid credentials for an affected device could exploit this vulnerability by remotely accessing a VTY line to the device. A successful exploit could allow the attacker to access an affected device with the privileges of the user who previously logged in to the web UI. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled and authentication, authorization, and accounting (AAA) authorization is not configured for EXEC sessions. The default state of the HTTP Server feature is version-dependent. This vulnerability was introduced in Cisco IOS XE Software Release 16.1.1. Cisco Bug IDs: CSCvf71769.",
  "id": "GHSA-4jvx-6g9p-mgxw",
  "modified": "2022-05-13T01:30:23Z",
  "published": "2022-05-13T01:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0152"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xepriv"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103558"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1040597"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4JW2-24WG-VCF7

Vulnerability from github – Published: 2022-01-04 00:01 – Updated: 2022-01-15 00:03
VLAI
Details

In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-25981"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-03T07:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin\u2019s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)",
  "id": "GHSA-4jw2-24wg-vcf7",
  "modified": "2022-01-15T00:03:42Z",
  "published": "2022-01-04T00:01:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25981"
    },
    {
      "type": "WEB",
      "url": "https://github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34"
    },
    {
      "type": "WEB",
      "url": "https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-4M38-CFR7-JX25

Vulnerability from github – Published: 2025-10-31 15:30 – Updated: 2025-11-03 18:31
VLAI
Details

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session detecting it. The web server allows the attacker to reuse an old session JWT token while the legitimate session is active.

Severity
7.7 (High)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-64386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-31T14:16:13Z",
    "severity": "HIGH"
  },
  "details": "The\nequipment grants a JWT token for each connection in the timeline, but during an\nactive valid session, a hijacking of the token can be done. This will allow an\nattacker with the token modify parameters of security, access or even steal the\nsession without\nthe legitimate and active session detecting it. The web server allows the\nattacker to reuse an old session JWT token while the legitimate session is\nactive.",
  "id": "GHSA-4m38-cfr7-jx25",
  "modified": "2025-11-03T18:31:51Z",
  "published": "2025-10-31T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64386"
    },
    {
      "type": "WEB",
      "url": "https://cds.thalesgroup.com/es/s21sec-about"
    },
    {
      "type": "WEB",
      "url": "https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010."
    },
    {
      "type": "WEB",
      "url": "https://www.hackrtu.com/blog/cg-0day-en-003"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}
Mitigation
Implementation

Set sessions/credentials expiration date.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list