CVE-2025-1968CWE-613

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session…

High · published April 9, 2025

CVSS v3.1
7.7
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.1th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2025-04-09T13:33Z
EPSS history
Timeline
  • 09 APR 13:33Z
    Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session…
    cvelistv5