CVE-2025-3930

Katalog CVE

CVSS 6.3 · Medium EPSS 0,52%

Kerentanan Insufficient Session Expiration. Skor CVSS 4.0 6.3 (Medium) menurut cert.pl.

Deskripsi (NVD)

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

Rincian

Terbit di NVD

16 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

6.3 (Medium), sumber cert.pl
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://cert.pl/en/posts/2025/06/CVE-2025-3930
• https://github.com/strapi/strapi
• https://strapi.io/
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025