PT-2025-48367 · Orangehrm · Orangehrm

Publicado 2025-11-29 · Atualizado 2025-12-03 · CVE-2025-66289

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OrangeHRM versions 5.0 through 5.7

Description OrangeHRM does not invalidate existing sessions when a user is disabled or a password change occurs, allowing active session cookies to remain valid indefinitely. This allows a disabled user, or an attacker using a compromised account, to continue accessing protected pages and perform operations. The server does not perform session revocation or session-store cleanup during critical state changes, meaning disabling an account or updating credentials has no effect on established sessions. This makes administrative disable actions ineffective and allows unauthorized users to retain full access even after an account is closed or a password is reset, exposing the system to prolonged unauthorized use and increasing the impact of account takeover scenarios.

Recommendations Update to version 5.8 or later.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2025-66289

GHSA-99QP-XH4Q-PR9X

Produtos afetados

Orangehrm

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66289.json · Exploit
• https://github.com/orangehrm/orangehrm/security/advisories/GHSA-99qp-xh4q-pr9x · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1994613184607469724 · Publicação no Twitter
• https://t.me/cveNotify/144325 · Publicação no Telegram
• https://t.me/CVEtracker/38469 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-66289 · Aviso do Fabricante
• https://twitter.com/dailycve/status/1996309492284133449 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-66289 · Nota de Segurança