GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-613

Allowed-with-Review

Insufficient Session Expiration

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

978 vulnerabilities reference this CWE, most recent first.

CVE-2024-31447 (GCVE-0-2024-31447)

Vulnerability from cvelistv5 – Published: 2024-04-08 15:39 – Updated: 2024-09-03 18:25
VLAI
Title
Shopware has Improper Session Handling in store-api
Summary
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-21 15:22 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
shopware shopware Affected: >= 6.3.5.0, < 6.5.8.8
Affected: >= 6.6.0.0-rc1, < 6.6.1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:52:56.942Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7"
          },
          {
            "name": "https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77"
          },
          {
            "name": "https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T15:22:21.295783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T18:25:39.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopware",
          "vendor": "shopware",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.3.5.0, \u003c 6.5.8.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.6.0.0-rc1, \u003c 6.6.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won\u0027t be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-08T15:48:24.047Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopware/shopware/security/advisories/GHSA-5297-wrrp-rcj7"
        },
        {
          "name": "https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopware/shopware/commit/5cc84ddd817ad0c1d07f9b3c79ab346d50514a77"
        },
        {
          "name": "https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopware/shopware/commit/d29775aa758f70d08e0c5999795c7c26d230e7d3"
        }
      ],
      "source": {
        "advisory": "GHSA-5297-wrrp-rcj7",
        "discovery": "UNKNOWN"
      },
      "title": "Shopware has Improper Session Handling in store-api"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-31447",
    "datePublished": "2024-04-08T15:39:29.678Z",
    "dateReserved": "2024-04-03T17:55:32.645Z",
    "dateUpdated": "2024-09-03T18:25:39.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-30262 (GCVE-0-2024-30262)

Vulnerability from cvelistv5 – Published: 2024-04-09 16:45 – Updated: 2024-08-02 01:32
VLAI
Title
Contao's remember-me tokens will not be cleared after a password change
Summary
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-10 19:19 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
  • CWE-384 - Session Fixation
Assigner
References
Impacted products
Vendor Product Version
contao contao Affected: < 4.13.40
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-30262",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-10T19:19:06.729095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:39:15.815Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:32:07.058Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"
          },
          {
            "name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "contao",
          "vendor": "contao",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.13.40"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable \"Allow auto login\" in the login module.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-384",
              "description": "CWE-384: Session Fixation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-09T16:45:57.132Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/contao/contao/security/advisories/GHSA-r4r6-j2j3-7pp5"
        },
        {
          "name": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9"
        }
      ],
      "source": {
        "advisory": "GHSA-r4r6-j2j3-7pp5",
        "discovery": "UNKNOWN"
      },
      "title": "Contao\u0027s remember-me tokens will not be cleared after a password change"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-30262",
    "datePublished": "2024-04-09T16:45:57.132Z",
    "dateReserved": "2024-03-26T12:52:00.935Z",
    "dateUpdated": "2024-08-02T01:32:07.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-29070 (GCVE-0-2024-29070)

Vulnerability from cvelistv5 – Published: 2024-07-23 08:13 – Updated: 2024-09-13 17:04
VLAI
Title
Apache StreamPark: session not invalidated after logout
Summary
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout. Mitigation: all users should upgrade to 2.1.4
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-23 14:42 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache StreamPark Affected: 1.0.0 , < 2.1.4 (semver)
Create a notification for this product.
apache_software_foundation apache_streampark Affected: 1.0.0 , < 2.1.4 (semver)
    cpe:2.3:a:apache_software_foundation:apache_streampark:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
L0ne1y
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache_software_foundation:apache_streampark:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "apache_streampark",
            "vendor": "apache_software_foundation",
            "versions": [
              {
                "lessThan": "2.1.4",
                "status": "affected",
                "version": "1.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-29070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-23T14:42:15.338950Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T14:47:17.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-13T17:04:30.274Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/22/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache StreamPark",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.1.4",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "L0ne1y"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "On versions before 2.1.4,\u0026nbsp;session is not invalidated after logout. When the user logged in successfully, the Backend service returns \"Authorization\" as the front-end authentication credential. \"Authorization\" can still initiate requests and access data even after logout.\u003cbr\u003e\u003cbr\u003e\u003cdiv\u003eMitigation:\u003cbr\u003e\u003cbr\u003e\u003c/div\u003eall users \u003cspan style=\"background-color: var(--wht);\"\u003eshould upgrade to 2.1.4\u003c/span\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "On versions before 2.1.4,\u00a0session is not invalidated after logout. When the user logged in successfully, the Backend service returns \"Authorization\" as the front-end authentication credential. \"Authorization\" can still initiate requests and access data even after logout.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\n"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-23T08:13:41.408Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/zslblrz1l0n9t67mqdv42yv75ncfn9zl"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache StreamPark: session not invalidated after logout",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-29070",
    "datePublished": "2024-07-23T08:13:41.408Z",
    "dateReserved": "2024-03-15T03:21:44.446Z",
    "dateUpdated": "2024-09-13T17:04:30.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27782 (GCVE-0-2024-27782)

Vulnerability from cvelistv5 – Published: 2024-07-09 15:33 – Updated: 2026-01-09 16:36
VLAI
Summary
Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests.
Severity
7.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-09 16:54 UTC
CWE
  • CWE-613 - Improper access control
Assigner
References
Impacted products
Vendor Product Version
Fortinet FortiAIOps Affected: 2.0.0
    cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*
Create a notification for this product.
fortinet fortiaiops Affected: 2.0.0
    cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "fortiaiops",
            "vendor": "fortinet",
            "versions": [
              {
                "status": "affected",
                "version": "2.0.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T16:54:40.346669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-09T16:57:20.062Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:41:54.447Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-069",
            "tags": [
              "x_transferred"
            ],
            "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-069"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAIOps",
          "vendor": "Fortinet",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-09T16:36:59.722Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-069",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-069"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiAIOps version 2.0.1 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2024-27782",
    "datePublished": "2024-07-09T15:33:30.678Z",
    "dateReserved": "2024-02-26T14:46:31.335Z",
    "dateUpdated": "2026-01-09T16:36:59.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-27779 (GCVE-0-2024-27779)

Vulnerability from cvelistv5 – Published: 2025-07-18 07:58 – Updated: 2026-02-26 17:50
VLAI
Summary
An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.
Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-19 03:55 UTC
CWE
  • CWE-613 - Improper access control
Assigner
References
Impacted products
Vendor Product Version
Fortinet FortiSandbox Affected: 4.4.0 , ≤ 4.4.4 (semver)
Affected: 4.2.1 , ≤ 4.2.6 (semver)
Affected: 4.0.0 , ≤ 4.0.6 (semver)
Affected: 3.2.0 , ≤ 3.2.4 (semver)
    cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*
Create a notification for this product.
Fortinet FortiIsolator Affected: 2.4.0 , ≤ 2.4.4 (semver)
Affected: 2.3.0 , ≤ 2.3.4 (semver)
Affected: 2.2.0
Affected: 2.1.0 , ≤ 2.1.2 (semver)
Affected: 2.0.0 , ≤ 2.0.1 (semver)
Affected: 1.2.0 , ≤ 1.2.2 (semver)
    cpe:2.3:a:fortinet:fortiisolator:2.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:1.2.0:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-19T03:55:14.366116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:50:28.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "4.4.4",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.6",
              "status": "affected",
              "version": "4.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.2.4",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiisolator:2.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.1.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:1.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:1.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiIsolator",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "2.4.4",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.3.4",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.2.0"
            },
            {
              "lessThanOrEqual": "2.1.2",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.0.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.2.2",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin\u0027s session even after the admin user was deleted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-14T14:15:41.227Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-035",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-035"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiSandbox version 4.4.5 or above\nUpgrade to FortiSandbox version 4.2.7 or above\nUpgrade to FortiIsolator version 2.4.5 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2024-27779",
    "datePublished": "2025-07-18T07:58:23.943Z",
    "dateReserved": "2024-02-26T14:46:31.334Z",
    "dateUpdated": "2026-02-26T17:50:28.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-25954 (GCVE-0-2024-25954)

Vulnerability from cvelistv5 – Published: 2024-03-28 18:38 – Updated: 2024-08-01 23:52
VLAI
Summary
Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-29 14:12 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
Dell PowerScale OneFS Affected: 9.5.0.0 , ≤ 9.5.0.7 (semver)
Affected: 9.6.1.0 , ≤ 9.7.0.0 (semver)
Affected: 9.7.0.0 , ≤ 9.7.0.1 (semver)
Create a notification for this product.
dell powerscale_onefs Affected: 9.5.0.0 , < 9.5.0.8 (custom)
Affected: 9.6.1.0 , < 9.7.0.2 (custom)
    cpe:2.3:a:dell:powerscale_onefs:9.5.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:dell:powerscale_onefs:9.6.1:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2024-03-28 06:30
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:dell:powerscale_onefs:9.5.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:dell:powerscale_onefs:9.6.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "powerscale_onefs",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "9.5.0.8",
                "status": "affected",
                "version": "9.5.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.7.0.2",
                "status": "affected",
                "version": "9.6.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-29T14:12:52.552130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-01T14:55:29.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:52:06.326Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerScale OneFS",
          "vendor": "Dell",
          "versions": [
            {
              "lessThanOrEqual": "9.5.0.7",
              "status": "affected",
              "version": "9.5.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.7.0.0",
              "status": "affected",
              "version": "9.6.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.7.0.1",
              "status": "affected",
              "version": "9.7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-03-28T06:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service."
            }
          ],
          "value": "Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-28T18:38:09.593Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2024-25954",
    "datePublished": "2024-03-28T18:38:09.593Z",
    "dateReserved": "2024-02-13T05:32:19.479Z",
    "dateUpdated": "2024-08-01T23:52:06.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-25628 (GCVE-0-2024-25628)

Vulnerability from cvelistv5 – Published: 2024-02-16 20:23 – Updated: 2024-08-06 15:49
VLAI
Title
Insufficient Session Expiration in alf.io
Summary
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-20 15:07 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
alfio-event alf.io Affected: < 2.0-M4-2402
Create a notification for this product.
alfio-event alf.io Affected: 0 , < 2.0-m4-2402 (custom)
    cpe:2.3:a:alfio-event:alf.io:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:44:09.877Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:alfio-event:alf.io:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "alf.io",
            "vendor": "alfio-event",
            "versions": [
              {
                "lessThan": "2.0-m4-2402",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25628",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:07:54.620721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-06T15:49:15.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alf.io",
          "vendor": "alfio-event",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0-M4-2402"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T20:23:44.693Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893"
        }
      ],
      "source": {
        "advisory": "GHSA-8p6m-mm22-q893",
        "discovery": "UNKNOWN"
      },
      "title": "Insufficient Session Expiration in alf.io"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-25628",
    "datePublished": "2024-02-16T20:23:44.693Z",
    "dateReserved": "2024-02-08T22:26:33.512Z",
    "dateUpdated": "2024-08-06T15:49:15.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-25619 (GCVE-0-2024-25619)

Vulnerability from cvelistv5 – Published: 2024-02-14 20:50 – Updated: 2024-08-01 23:44
VLAI
Title
Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
Summary
Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn't actually fire, since `delete_all` doesn't trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application's Access Tokens are being "killed". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability.
Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-15 20:06 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
  • CWE-672 - Operation on a Resource after Expiration or Release
Assigner
References
Impacted products
Vendor Product Version
mastodon mastodon Affected: >= 4.2.6, < 4.2.6
Affected: >= 4.1.0, < 4.1.14
Affected: >= 4.0.0, < 4.0.14
Affected: < 3.5.18
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-15T20:06:57.515329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:59.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:44:09.688Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x"
          },
          {
            "name": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mastodon",
          "vendor": "mastodon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.6, \u003c 4.2.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.14"
            },
            {
              "status": "affected",
              "version": "\u003c 3.5.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn\u0027t being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn\u0027t actually fire, since `delete_all` doesn\u0027t trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application\u0027s Access Tokens are being \"killed\". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-672",
              "description": "CWE-672: Operation on a Resource after Expiration or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-14T20:50:10.809Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x"
        },
        {
          "name": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71"
        }
      ],
      "source": {
        "advisory": "GHSA-7w3c-p9j8-mq3x",
        "discovery": "UNKNOWN"
      },
      "title": "Destroying OAuth Applications doesn\u0027t notify Streaming of Access Tokens being destroyed in mastodon"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-25619",
    "datePublished": "2024-02-14T20:50:10.809Z",
    "dateReserved": "2024-02-08T22:26:33.511Z",
    "dateUpdated": "2024-08-01T23:44:09.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-25051 (GCVE-0-2024-25051)

Vulnerability from cvelistv5 – Published: 2025-04-02 14:57 – Updated: 2026-02-26 18:29
VLAI
Title
IBM Jazz Reporting Service insufficient session expiration
Summary
IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system.
Severity
6.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-03 03:55 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
URL Tags
https://www.ibm.com/support/pages/node/7229760 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM Jazz Reporting Service Affected: 7.0.2
Affected: 7.0.3
    cpe:2.3:a:ibm:jazz_reporting_service:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:jazz_reporting_service:7.0.3:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25051",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T03:55:30.607528Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:29:01.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:jazz_reporting_service:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:jazz_reporting_service:7.0.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Jazz Reporting Service",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.2"
            },
            {
              "status": "affected",
              "version": "7.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system."
            }
          ],
          "value": "IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-01T10:14:53.515Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7229760"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Jazz Reporting Service insufficient session expiration",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-25051",
    "datePublished": "2025-04-02T14:57:12.391Z",
    "dateReserved": "2024-02-03T14:49:33.094Z",
    "dateUpdated": "2026-02-26T18:29:01.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-23586 (GCVE-0-2024-23586)

Vulnerability from cvelistv5 – Published: 2024-09-27 21:20 – Updated: 2024-10-04 13:56
VLAI
Title
An insufficient session timeout vulnerability affects HCL Nomad server on Domino
Summary
HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker could obtain old session information.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-04 13:53 UTC
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
HCL Software Nomad server on Domino Affected: <1.0.13
Create a notification for this product.
hcltech nomad_server_on_domino Affected: 0 , < 1.0.13 (custom)
    cpe:2.3:a:hcltech:nomad_server_on_domino:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2024-09-27 21:13
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:hcltech:nomad_server_on_domino:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "nomad_server_on_domino",
            "vendor": "hcltech",
            "versions": [
              {
                "lessThan": "1.0.13",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-04T13:53:43.919681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-04T13:56:37.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nomad server on Domino",
          "vendor": "HCL Software",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c1.0.13"
            }
          ]
        }
      ],
      "datePublic": "2024-09-27T21:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability. \u0026nbsp; Under certain circumstances, an unauthenticated attacker could obtain old session information. \u0026nbsp;"
            }
          ],
          "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability. \u00a0 Under certain circumstances, an unauthenticated attacker could obtain old session information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-27T21:20:29.383Z",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0115264"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "An insufficient session timeout vulnerability affects HCL Nomad server on Domino",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2024-23586",
    "datePublished": "2024-09-27T21:20:29.383Z",
    "dateReserved": "2024-01-18T07:30:10.662Z",
    "dateUpdated": "2024-10-04T13:56:37.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}
Mitigation
Implementation

Set sessions/credentials expiration date.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list