CVE-2024-11627

Published: Jan 7, 2025Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

: Insufficient Session Expiration vulnerability in Progress Sitefinity allows : Session Fixation.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200 through 15.0.8229, from 15.1.8300 through 15.1.8327, from 15.2.8400 through 15.2.8421.

Affected (4)

Products: Progress: Sitefinity

Progress

1 product

Sitefinity

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Progress Sitefinity	From 15.0.8200 to 15.0.8230
Progress Sitefinity	From 15.1.8300 to 15.1.8328
Progress Sitefinity	From 15.2.8400 to 15.2.8422
Progress Sitefinity	From 4.0 to 14.4.8143

Related CWEs

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-11625-and-CVE-2024-11626-January-2025

Source: security@progress.com

Not Applicable

https://www.progress.com/sitefinity-cms

Source: security@progress.com

Product

Timeline

No history available yet.