BIT-arangodb-2021-25940

vendorUSosv

ArangoDB - Insufficient Session Expiration after Password Change

view advisory published 2025-03-10Licence: per source

In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-25940US	high8.0	0.81% (57th)	—	2021-11-16
In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated…

references

External citations — patches, advisories, analysis.

https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2021-25940WEB
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25940ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan