CVE-2025-10223CWE-613

CVE-2025-10223

Medium · published September 10, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows a local or remote authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2025-09-10T17:15Z
Affected products (1)
ProductVersionsFixed in
axxonsoft/axxon_one≤ 2.0.2—
References (1)
https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories · 15ede60e-6fda-426e-be9c-e788f151a377
EPSS history
Timeline
  • 10 SEP 12:35Z
    Improper Session Cleanup on Role Removal in Web Admin Panel in AxxonSoft Axxon One (C-Werk)
    cvelistv5