← Back

CVE-2019-7215

nvd nist
Published: Jun 6, 2019Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 3.9 / Impact: 2.5
Source: NVD

Description

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.

Affected (16)

Products: Progress: Sitefinity
Progress
1 product
Sitefinity
Configuration A
16 vulnerable
Vulnerable SoftwareAffected Versions
Progress
Sitefinity
10.0 ≤ version < 10.0.6429
Sitefinity
10.1 ≤ version ≤ 10.1.6540
Sitefinity
10.2 ≤ version < 10.2.6649
Sitefinity
11.0 ≤ version < 11.0.6736
Sitefinity
11.1 ≤ version < 11.1.6826
Sitefinity
11.2 ≤ version < 11.2.6929
Sitefinity
7.0 ≤ version < 7.0.5143
Sitefinity
7.1 ≤ version < 7.1.5243
Sitefinity
7.2 ≤ version < 7.2.5353
Sitefinity
7.3 ≤ version < 7.3.5693
Sitefinity
8.0 ≤ version < 8.0.5773
Sitefinity
8.1 ≤ version < 8.1.5863
Sitefinity
8.2 ≤ version < 8.2.5973
Sitefinity
9.0 ≤ version < 9.0.6063
Sitefinity
9.1 ≤ version < 9.1.6183
Sitefinity
9.2 ≤ version < 9.2.6274

Related CWEs

CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

Source: cve@mitre.org
Source: cve@mitre.org
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory

Timeline

No history available yet.