PT-2025-35200 · Pyload · Pyload

Arkadiusz Marta · Publicado 2025-08-29 · Atualizado 2025-08-29 · CVE-2025-4643

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.44.0

Description Payload utilizes JSON Web Tokens (JWT) for authentication. Following a user logout, the JWT is not invalidated, enabling an attacker who has obtained a valid token—through theft or interception—to reuse it until its expiration date. The default expiration date is two hours, but this duration is configurable.

Recommendations Update to version 3.44.0 or later.

Correção

Insufficient Session Expiration

Session Fixation

Enumeração de Fraquezas

CWE-613

CWE-384

Identificadores relacionados

CVE-2025-4643

GHSA-26RV-H2HF-3FW4

GHSA-5V66-M237-HWF7

Produtos afetados

Pyload

Referências · 13

• https://github.com/payloadcms/payload · Nota
• https://github.com/payloadcms/payload/commit/26d709dda6e512ce347557eaa2057db6e0cbf809 · Nota
• https://twitter.com/CVEnew/status/1961396075954065507 · Publicação no Twitter
• https://cert.pl/en/posts/2025/08/CVE-2025-4643 · Nota
• https://osv.dev/vulnerability/CVE-2025-4643 · Aviso do Fabricante
• https://t.me/CVEtracker/31227 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-26rv-h2hf-3fw4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-4644 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5v66-m237-hwf7 · Aviso do Fabricante
• https://payloadcms.com · Nota
• https://t.me/cveNotify/133906 · Publicação no Telegram
• https://t.me/cveNotify/133907 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-4643 · Nota de Segurança