PT-2025-6251 · Concorde · Concorde

Published 2025-02-11 · Updated 2025-02-11 · CVE-2025-24973

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Concorde versions prior to 12.25Q1.1

Description: The issue arises from an improper implementation of the logout process, causing authentication credentials to remain in cookies even after a user has explicitly logged out. This may allow an attacker to steal authentication tokens, potentially having devastating consequences if a user with admin privileges is or was using a shared device.

Recommendations: For versions prior to 12.25Q1.1, update to version 12.25Q1.1 to fix the issue. As a temporary workaround, clear cookies and site data in the browser after logging out. Users who have logged in on a shared device should go to Settings > Security and regenerate their login tokens.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-24973

GHSA-2369-P2WH-7CC2

Affected Products

Concorde

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24973.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24973 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24973 · Vendor Advisory
• https://github.com/nexryai/concorde/commit/1f6ac9b289906083b132e4f9667a31a60ef83e4e · Note
• https://github.com/nexryai/concorde/security/advisories/GHSA-2369-p2wh-7cc2 · Note
• https://twitter.com/CVEnew/status/1889341250287055239 · Twitter Post
• https://twitter.com/CveFindCom/status/1889344479057813510 · Twitter Post