PT-2022-9686 · Talkyard · Talkyard

Published 2022-01-03 · Updated 2022-01-14 · CVE-2021-25981

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Talkyard versions v0.2021.20 through v0.2021.33 Talkyard dev versions v0.2021.20 through v0.2021.34

Description The issue is related to Insufficient Session Expiration, which may allow an attacker to reuse the admin's still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token via other hypothetical attacks.

Recommendations For Talkyard versions v0.2021.20 through v0.2021.33, update to a version outside of this range to mitigate the risk. For Talkyard dev versions v0.2021.20 through v0.2021.34, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to session tokens to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-25981

Affected Products

Talkyard

References · 6

• https://github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34 · Patch
• https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761 · Patch
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25981 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25981 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25981 · Vendor Advisory
• https://t.me/cibsecurity/34843 · Telegram Post