PT-2021-16894 · Unknown · Camaleon Cms

Published 2021-10-20 · Updated 2022-05-24 · CVE-2021-25970

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 0.1.7 through 2.6.0

Description The issue arises when the admin changes a user's password, but the active session of the user is not terminated. As a result, a user who was already logged in will still have access to the application even after their password was changed.

Recommendations For Camaleon CMS versions 0.1.7 through 2.6.0, update to version 2.6.0.1 or later to resolve the issue.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-25970

GHSA-438X-2P9V-G8H9

Affected Products

Camaleon Cms

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/camaleon_cms/CVE-2021-25970.yml · Exploit
• https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25970 · Security Note
• https://osv.dev/vulnerability/GHSA-438x-2p9v-g8h9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25970 · Vendor Advisory
• https://github.com/owen2345/camaleon-cms · Note
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25970 · Note
• https://t.me/cibsecurity/30896 · Telegram Post