CVE-2021-25981

Published: Jan 3, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)

Affected (1)

Products: Talkyard: Talkyard

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Talkyard Talkyard	From 0.2021.20 to 0.2021.35

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (6)

https://github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34

Source: vulnerabilitylab@mend.io

PatchThird Party Advisory

https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761

Source: vulnerabilitylab@mend.io

PatchThird Party Advisory

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981

Source: vulnerabilitylab@mend.io

PatchThird Party AdvisoryVDB Entry

https://github.com/debiki/talkyard/commit/b0310df019887f3464895529c773bc7d85ddcf34

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/debiki/talkyard/commit/b0712915d8a22a20b09a129924e8a29c25ae5761

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25981

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryVDB Entry

Timeline

No history available yet.