CVE Feed

    Dashboard / CVE / CVE-2024-39809

    CVE-2024-39809

    The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

    Published:Aug 14, 2024
    Last Modified:Aug 22, 2024
    EPS:Aug 14, 2024
    EPSS Score:0.00211
    CVSS Score:7.5

    Affected Products

    Vendor
    F5
    Product
    Big-ip Next Central Manager

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-613 Insufficient Session Expiration

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-54500 (CVSS 6.9) — An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in or…
    CVE-2025-36504 (CVSS 8.7) — When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an …
    CVE-2025-41399 (CVSS 8.7) — When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requ…
    CVE-2025-23413 (CVSS 6.7) — When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sen…
    CVE-2025-24319 (CVSS 7.1) — When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can c…
    CVE-2024-37028 (CVSS 6.3) — BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note:…
    CVE-2024-41719 (CVSS 5.1) — When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credenti…
    CVE-2024-26026 (CVSS 7.5) — An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions w…
    CVE-2024-21793 (CVSS 7.5) — An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions…
    CVE-2024-33612 (CVSS 6.8) — An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attack…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High