Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2021-25992

Summary
Assigner-Mend
Assigner Org ID-478c68dd-22c1-4a41-97cd-654224dfacff
Published At-10 Feb, 2022 | 09:55
Updated At-16 Sep, 2024 | 16:53
Rejected At-
Credits

ifme - Insufficient Session Expiration

In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Mend
Assigner Org ID:478c68dd-22c1-4a41-97cd-654224dfacff
Published At:10 Feb, 2022 | 09:55
Updated At:16 Sep, 2024 | 16:53
Rejected At:
▼CVE Numbering Authority (CNA)
ifme - Insufficient Session Expiration

In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.

Affected Products
Vendor
ifmeorg
Product
ifme
Versions
Affected
  • From 1.0.0 before unspecified (custom)
  • From unspecified through v7.33.2 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-613CWE-613 Insufficient Session Expiration
Type: CWE
CWE ID: CWE-613
Description: CWE-613 Insufficient Session Expiration
Metrics
VersionBase scoreBase severityVector
3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Update version to v.7.33.3

Configurations
Workarounds
Exploits
Credits
WhiteSource Vulnerability Research Team (WVR)
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611
x_refsource_MISC
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992
x_refsource_MISC
Hyperlink: https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611
Resource:
x_refsource_MISC
Hyperlink: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611
x_refsource_MISC
x_transferred
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992
x_refsource_MISC
x_transferred
Hyperlink: https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:vulnerabilitylab@mend.io
Published At:10 Feb, 2022 | 10:15
Updated At:22 Feb, 2022 | 21:48

In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary2.07.5HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
Type: Primary
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 2.0
Base score: 7.5
Base severity: HIGH
Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
CPE Matches
if-me
if-me
>>ifme>>Versions from 1.0.0(inclusive) to 7.33.2(inclusive)
cpe:2.3:a:if-me:ifme:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-613Primaryvulnerabilitylab@mend.io
CWE ID: CWE-613
Type: Primary
Source: vulnerabilitylab@mend.io
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611vulnerabilitylab@mend.io
Patch
Third Party Advisory
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992vulnerabilitylab@mend.io
Exploit
Third Party Advisory
Hyperlink: https://github.com/ifmeorg/ifme/commit/014f6d3526a594109d4d6607c2f30b1865e37611
Source: vulnerabilitylab@mend.io
Resource:
Patch
Third Party Advisory
Hyperlink: https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25992
Source: vulnerabilitylab@mend.io
Resource:
Exploit
Third Party Advisory

Change History

0
Information is not available yet

Similar CVEs

61Records found
CVE-2022-4070
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
ShareView Details
Matching Score-4
Assigner-Protect AI (formerly huntr.dev)
CVSS Score-2.7||LOW
EPSS-0.00% / 0.01%
||
7 Day CHG~0.00%
Published-20 Nov, 2022 | 00:00
Updated-14 Apr, 2025 | 18:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Insufficient Session Expiration in librenms/librenms

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.

Action-Not Available
Vendor-LibreNMS
Product-librenmslibrenms/librenms
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2022-36179
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.12% / 31.06%
||
7 Day CHG~0.00%
Published-22 Nov, 2022 | 00:00
Updated-29 Apr, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Fusiondirectory 1.3 suffers from Improper Session Handling.

Action-Not Available
Vendor-fusiondirectoryn/a
Product-fusiondirectoryn/a
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2022-35728
Matching Score-4
Assigner-F5, Inc.
ShareView Details
Matching Score-4
Assigner-F5, Inc.
CVSS Score-8.1||HIGH
EPSS-0.68% / 70.63%
||
7 Day CHG~0.00%
Published-04 Aug, 2022 | 17:49
Updated-16 Sep, 2024 | 16:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
iControl REST vulnerability CVE-2022-35728

In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Action-Not Available
Vendor-F5, Inc.
Product-big-ip_application_acceleration_managerbig-ip_link_controllerbig-ip_policy_enforcement_managerbig-ip_fraud_protection_servicebig-iq_centralized_managementbig-ip_global_traffic_managerbig-ip_analyticsbig-ip_access_policy_managerbig-ip_domain_name_systembig-ip_local_traffic_managerbig-ip_advanced_firewall_managerbig-ip_application_security_managerBIG-IQ Centralized ManagementBIG-IP
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2021-21031
Matching Score-4
Assigner-Adobe Systems Incorporated
ShareView Details
Matching Score-4
Assigner-Adobe Systems Incorporated
CVSS Score-5.6||MEDIUM
EPSS-0.16% / 37.35%
||
7 Day CHG~0.00%
Published-11 Feb, 2021 | 19:28
Updated-16 Sep, 2024 | 20:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Action-Not Available
Vendor-magentoAdobe Inc.
Product-magentoMagento.com
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2024-42447
Matching Score-4
Assigner-Apache Software Foundation
ShareView Details
Matching Score-4
Assigner-Apache Software Foundation
CVSS Score-9.8||CRITICAL
EPSS-0.76% / 72.34%
||
7 Day CHG~0.00%
Published-05 Aug, 2024 | 08:02
Updated-19 Mar, 2025 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.   * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.  Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.

Action-Not Available
Vendor-The Apache Software Foundation
Product-apache-airflow-providers-fabairflowApache Airflow Providers FAB
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2020-35358
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-1.48% / 80.16%
||
7 Day CHG~0.00%
Published-15 Mar, 2021 | 11:55
Updated-04 Aug, 2024 | 17:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality.

Action-Not Available
Vendor-domainmodn/a
Product-domainmodn/a
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2020-27416
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.73% / 71.67%
||
7 Day CHG~0.00%
Published-08 Dec, 2021 | 18:36
Updated-04 Aug, 2024 | 16:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to control a users account.

Action-Not Available
Vendor-mahadiscomn/a
Product-mahavitarann/a
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2024-29401
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.10% / 28.17%
||
7 Day CHG~0.00%
Published-26 Mar, 2024 | 00:00
Updated-05 Aug, 2024 | 19:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.

Action-Not Available
Vendor-n/amindskip
Product-n/axzs-mysql
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2024-41827
Matching Score-4
Assigner-JetBrains s.r.o.
ShareView Details
Matching Score-4
Assigner-JetBrains s.r.o.
CVSS Score-7.4||HIGH
EPSS-0.00% / 0.06%
||
7 Day CHG~0.00%
Published-22 Jul, 2024 | 14:50
Updated-07 Aug, 2024 | 20:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration

Action-Not Available
Vendor-JetBrains s.r.o.
Product-teamcityTeamCityteamcity
CWE ID-CWE-613
Insufficient Session Expiration
CVE-2020-1762
Matching Score-4
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-4
Assigner-Red Hat, Inc.
CVSS Score-7||HIGH
EPSS-1.30% / 78.92%
||
7 Day CHG~0.00%
Published-27 Apr, 2020 | 20:41
Updated-04 Aug, 2024 | 06:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

Action-Not Available
Vendor-kiali[Kiali]Red Hat, Inc.
Product-kialiopenshift_service_meshkiali
CWE ID-CWE-613
Insufficient Session Expiration
CWE ID-CWE-384
Session Fixation
CVE-2020-17474
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.38% / 58.43%
||
7 Day CHG~0.00%
Published-14 Aug, 2020 | 19:22
Updated-04 Aug, 2024 | 13:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database.

Action-Not Available
Vendor-n/aZKTeco Co., Ltd.
Product-facedepot_7b_firmwarezkbiosecurity_serverfacedepot_7bn/a
CWE ID-CWE-613
Insufficient Session Expiration
  • Previous
  • 1
  • 2
  • Next
Details not found