CVE-2021-25970 - CVE House

Status published High CVE-2021-25970

Camaleon CMS - Insufficient Session Expiration after Password Change

8.8 CVSS

Vulnerability Description

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-25970

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from camaleon_cms

View All →

CVE-2021-25972

Camaleon CMS - Server-Side Request Forgery (SSRF) in Media Upload Feature

Medium 4.9

CVE-2021-25971

Camaleon CMS - SVG File Upload Creates DoS for Media Upload Feature

Medium 4.3

CVE-2021-25969

Camaleon CMS - Stored Cross-Site Scripting (XSS) in Comments

Medium 6.1

Affected Vendor

camaleon_cms

View all reports →

Affected Software

camaleon_cms

Vulnerable Versions:

0.1.7, unspecified

Timeline

Official Publish: October 20th, 2021

Last Modified: April 30th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-613

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie

Credential Access

T1078 Valid Accounts

Persistence

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1562 Impair Defenses