Riskcovery

CVE-2021-25966

Orchard Core CMS - Improper Session Termination after Password Change

State
Published
Severity
8.8 High
Published
Oct 10, 2021
Updated
Apr 30, 2025
Reserved
Jan 22, 2021

Read the record on cve.org

Description

In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HMend

Weaknesses

  • CWE-613 Insufficient Session Expiration

Affected Products

ProductVersions
UsersOrchardCore
  • 1.0.0-beta1-3383 to before unspecifiedAffected
  • 1.0.0 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.