Vulnerability-Lookup

CVE-2021-25970 (GCVE-0-2021-25970)

Vulnerability from cvelistv5 – Published: 2021-10-20 11:55 – Updated: 2025-04-30 15:53

Title

Camaleon CMS - Insufficient Session Expiration after Password Change

Summary

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-30 15:50 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

Mend CNA

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://github.com/owen2345/camaleon-cms/commit/7…	x_refsource_MISC
https://www.whitesourcesoftware.com/vulnerability…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
camaleon_cms	camaleon_cms	Affected: 0.1.7 , < unspecified (custom) Affected: unspecified , ≤ 2.6.0 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:19:19.297Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-25970",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-30T15:50:14.323724Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-30T15:53:18.740Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "camaleon_cms",
          "vendor": "camaleon_cms",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0.1.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-20T11:55:15.000Z",
        "orgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
        "shortName": "Mend"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update to 2.6.0.1"
        }
      ],
      "source": {
        "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
        "discovery": "UNKNOWN"
      },
      "title": "Camaleon CMS - Insufficient Session Expiration after Password Change",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
          "ID": "CVE-2021-25970",
          "STATE": "PUBLIC",
          "TITLE": "Camaleon CMS - Insufficient Session Expiration after Password Change"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "camaleon_cms",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003e=",
                            "version_value": "0.1.7"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.6.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "camaleon_cms"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-613 Insufficient Session Expiration"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030",
              "refsource": "MISC",
              "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
            },
            {
              "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970",
              "refsource": "MISC",
              "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update to 2.6.0.1"
          }
        ],
        "source": {
          "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
    "assignerShortName": "Mend",
    "cveId": "CVE-2021-25970",
    "datePublished": "2021-10-20T11:55:16.000Z",
    "dateReserved": "2021-01-22T00:00:00.000Z",
    "dateUpdated": "2025-04-30T15:53:18.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-25970",
      "date": "2026-10-29",
      "epss": "0.01307",
      "percentile": "0.70504"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DAC41EAB-C69C-42B1-8B07-D9C56B010CC5",
                    "versionEndIncluding": "2.6.0",
                    "versionStartIncluding": "0.1.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
          },
          {
            "lang": "es",
            "value": "Camaleon CMS versiones 0.1.7 a 2.6.0, no termina la sesi\u00f3n activa de los usuarios, incluso despu\u00e9s de que el administrador cambie la contrase\u00f1a del usuario. Un usuario que ya estaba conectado, seguir\u00e1 teniendo acceso a la aplicaci\u00f3n incluso despu\u00e9s de que la contrase\u00f1a fue cambiada"
          }
        ],
        "id": "CVE-2021-25970",
        "lastModified": "2024-11-21T05:55:42.110",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "vulnerabilitylab@mend.io",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-10-20T12:15:07.587",
        "references": [
          {
            "source": "vulnerabilitylab@mend.io",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
          },
          {
            "source": "vulnerabilitylab@mend.io",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
          }
        ],
        "sourceIdentifier": "vulnerabilitylab@mend.io",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-613"
              }
            ],
            "source": "vulnerabilitylab@mend.io",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-613"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T04:53:45+00:00",
      "cve": "CVE-2021-25970",
      "id": "CVE-2021-25970",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Camaleon CMS - Insufficient Session Expiration after Password Change",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-25970.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T20:19:19.297Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
              },
              {
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-25970",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-30T15:50:14.323724Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-30T15:51:36.380Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "camaleon_cms",
              "vendor": "camaleon_cms",
              "versions": [
                {
                  "lessThan": "unspecified",
                  "status": "affected",
                  "version": "0.1.7",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.6.0",
                  "status": "affected",
                  "version": "unspecified",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-613",
                  "description": "CWE-613 Insufficient Session Expiration",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2021-10-20T11:55:15.000Z",
            "orgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
            "shortName": "Mend"
          },
          "references": [
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
            },
            {
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update to 2.6.0.1"
            }
          ],
          "source": {
            "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
            "discovery": "UNKNOWN"
          },
          "title": "Camaleon CMS - Insufficient Session Expiration after Password Change",
          "x_generator": {
            "engine": "Vulnogram 0.0.9"
          },
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
              "ID": "CVE-2021-25970",
              "STATE": "PUBLIC",
              "TITLE": "Camaleon CMS - Insufficient Session Expiration after Password Change"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "camaleon_cms",
                          "version": {
                            "version_data": [
                              {
                                "version_affected": "\u003e=",
                                "version_value": "0.1.7"
                              },
                              {
                                "version_affected": "\u003c=",
                                "version_value": "2.6.0"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "camaleon_cms"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
                }
              ]
            },
            "generator": {
              "engine": "Vulnogram 0.0.9"
            },
            "impact": {
              "cvss": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "CWE-613 Insufficient Session Expiration"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030",
                  "refsource": "MISC",
                  "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
                },
                {
                  "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970",
                  "refsource": "MISC",
                  "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
                }
              ]
            },
            "solution": [
              {
                "lang": "en",
                "value": "Update to 2.6.0.1"
              }
            ],
            "source": {
              "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
              "discovery": "UNKNOWN"
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "478c68dd-22c1-4a41-97cd-654224dfacff",
        "assignerShortName": "Mend",
        "cveId": "CVE-2021-25970",
        "datePublished": "2021-10-20T11:55:16.000Z",
        "dateReserved": "2021-01-22T00:00:00.000Z",
        "dateUpdated": "2025-04-30T15:53:18.740Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2021-25970

Vulnerability from fkie_nvd - Published: 2021-10-20 12:15 - Updated: 2026-06-17 03:42

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
vulnerabilitylab@mend.io	https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030	Patch, Third Party Advisory
vulnerabilitylab@mend.io	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970	Third Party Advisory

Impacted products

	Vendor	Product	Version
	tuzitio	camaleon_cms	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "camaleon_cms",
          "vendor": "camaleon_cms",
          "versions": [
            {
              "lessThan": "unspecified",
              "status": "affected",
              "version": "0.1.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2.6.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "vulnerabilitylab@mend.io"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAC41EAB-C69C-42B1-8B07-D9C56B010CC5",
              "versionEndIncluding": "2.6.0",
              "versionStartIncluding": "0.1.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
    },
    {
      "lang": "es",
      "value": "Camaleon CMS versiones 0.1.7 a 2.6.0, no termina la sesi\u00f3n activa de los usuarios, incluso despu\u00e9s de que el administrador cambie la contrase\u00f1a del usuario. Un usuario que ya estaba conectado, seguir\u00e1 teniendo acceso a la aplicaci\u00f3n incluso despu\u00e9s de que la contrase\u00f1a fue cambiada"
    }
  ],
  "id": "CVE-2021-25970",
  "lastModified": "2026-06-17T03:42:42.097",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "vulnerabilitylab@mend.io",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-25970",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-30T15:50:14.323724Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2021-10-20T12:15:07.587",
  "references": [
    {
      "source": "vulnerabilitylab@mend.io",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
    },
    {
      "source": "vulnerabilitylab@mend.io",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
    }
  ],
  "sourceIdentifier": "vulnerabilitylab@mend.io",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "vulnerabilitylab@mend.io",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-438X-2P9V-G8H9

Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2023-03-01 18:56

Summary

Camaleon CMS Insufficient Session Expiration vulnerability

Details

Camaleon CMS 0.1.7 through 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed. Resolved in commit 77e31bc6cdde7c951fba104aebcd5ebb3f02b030 which is included in the 2.6.0.1 release.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "camaleon_cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.7"
            },
            {
              "fixed": "2.6.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-25970"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-24T15:59:43Z",
    "nvd_published_at": "2021-10-20T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "Camaleon CMS 0.1.7 through 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed. Resolved in commit `77e31bc6cdde7c951fba104aebcd5ebb3f02b030` which is included in the `2.6.0.1` release.",
  "id": "GHSA-438x-2p9v-g8h9",
  "modified": "2023-03-01T18:56:46Z",
  "published": "2022-05-24T22:28:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25970"
    },
    {
      "type": "WEB",
      "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/owen2345/camaleon-cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2021-25970.yml"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Camaleon CMS Insufficient Session Expiration vulnerability"
}

GSD-2021-25970

Vulnerability from gsd - Updated: 2022-05-24 00:00

Details

Aliases

CVE-2021-25970

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-25970",
    "description": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed.",
    "id": "GSD-2021-25970"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "camaleon_cms",
            "purl": "pkg:gem/camaleon_cms"
          }
        }
      ],
      "aliases": [
        "CVE-2021-25970",
        "GHSA-438x-2p9v-g8h9"
      ],
      "details": "Camaleon CMS 0.1.7 through 2.6.0 doesn\u2019t terminate the active session\nof the users, even after the admin changes the user\u2019s password. A user that was\nalready logged in, will still have access to the application even after the password\nwas changed.\n",
      "id": "GSD-2021-25970",
      "modified": "2022-05-24T00:00:00.000Z",
      "published": "2022-05-24T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
        },
        {
          "type": "WEB",
          "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 8.8,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Camaleon CMS Insufficient Session Expiration vulnerability"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
        "ID": "CVE-2021-25970",
        "STATE": "PUBLIC",
        "TITLE": "Camaleon CMS - Insufficient Session Expiration after Password Change"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "camaleon_cms",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003e=",
                          "version_value": "0.1.7"
                        },
                        {
                          "version_affected": "\u003c=",
                          "version_value": "2.6.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "camaleon_cms"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-613 Insufficient Session Expiration"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030",
            "refsource": "MISC",
            "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
          },
          {
            "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970",
            "refsource": "MISC",
            "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
          }
        ]
      },
      "solution": [
        {
          "lang": "eng",
          "value": "Update to 2.6.0.1"
        }
      ],
      "source": {
        "advisory": "https://www.whitesourcesoftware.com/vulnerability-database/",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2021-25970",
      "cvss_v3": 8.8,
      "date": "2022-05-24",
      "description": "Camaleon CMS 0.1.7 through 2.6.0 doesn\u2019t terminate the active session\nof the users, even after the admin changes the user\u2019s password. A user that was\nalready logged in, will still have access to the application even after the password\nwas changed.\n",
      "gem": "camaleon_cms",
      "ghsa": "438x-2p9v-g8h9",
      "patched_versions": [
        "\u003e= 2.6.0.1"
      ],
      "related": {
        "url": [
          "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
        ]
      },
      "title": "Camaleon CMS Insufficient Session Expiration vulnerability",
      "unaffected_versions": [
        "\u003c 0.1.7"
      ],
      "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=0.1.7 \u003c=2.6.0",
          "affected_versions": "All versions starting from 0.1.7 up to 2.6.0",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-613",
            "CWE-937"
          ],
          "date": "2021-10-29",
          "description": "Camaleon CMS to doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed.",
          "fixed_versions": [
            "2.6.0.1"
          ],
          "identifier": "CVE-2021-25970",
          "identifiers": [
            "CVE-2021-25970"
          ],
          "not_impacted": "All versions before 0.1.7, all versions after 2.6.0",
          "package_slug": "gem/camaleon_cms",
          "pubdate": "2021-10-20",
          "solution": "Upgrade to version 2.6.0.1 or above.",
          "title": "Insufficient Session Expiration",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-25970"
          ],
          "uuid": "7f175b41-17a7-4045-bb76-19066d848851"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tuzitio:camaleon_cms:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.6.0",
                "versionStartIncluding": "0.1.7",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerabilitylab@whitesourcesoftware.com",
          "ID": "CVE-2021-25970"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Camaleon CMS 0.1.7 to 2.6.0 doesn\u2019t terminate the active session of the users, even after the admin changes the user\u2019s password. A user that was already logged in, will still have access to the application even after the password was changed."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-613"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970"
            },
            {
              "name": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2021-10-29T18:40Z",
      "publishedDate": "2021-10-20T12:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-25970 (GCVE-0-2021-25970)

FKIE_CVE-2021-25970

GHSA-438X-2P9V-G8H9

GSD-2021-25970

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour