CVE-2025-59335

Katalog CVE

CVSS 7.1 · High EPSS 0,21%

Kerentanan Insufficient Session Expiration pada cubecart. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access even after the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has no way to revoke the attacker’s access. The malicious actor retains full access to the account until their session naturally expires. This means the account remains insecure even after the password has been changed. This issue has been patched in version 6.5.11.

Rincian

Terbit di NVD

22 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cubecart/v6/security/advisories/GHSA-4vwh-x8m2-fmvv exploit · advisory vendor
• https://github.com/cubecart/v6/commit/4bfaeb4485dd82255a108940a163af5ba4583b52 patch
• https://github.com/cubecart/v6/commit/62d9be8416aa6fd7343f8932d98c5b112b163e26 patch