CVE-2021-25981

Katalog CVE

CVSS 9.8 · Critical EPSS 2,5%

Kerentanan Insufficient Session Expiration pada talkyard. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)

Rincian

Terbit di NVD

3 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34 patch · advisory pihak ketiga
• https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761 patch · advisory pihak ketiga
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981 patch · advisory pihak ketiga · vdb entry