CVE-2021-25970

Camaleon CMS - Insufficient Session Expiration after Password Change

State: Published
Severity: 8.8 High
Published: Oct 20, 2021
Updated: Apr 30, 2025
Reserved: Jan 22, 2021

Description

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Mend

Weaknesses

CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
camaleon_cmscamaleon_cms	0.1.7 to before unspecifiedAffected 2.6.0 and earlierAffected

References

https://github.com/owen2345/camaleon-cms/commit/77e31bc6cdde7c951fba104aebcd5ebb3f02b030
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25970

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.