CVE-2025-1968

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.

Published:Apr 9, 2025

Last Modified:Apr 15, 2026

EPS:Apr 9, 2025

EPSS Score:0.00252

CVSS Score:7.7

Affected Products

No affected product recorded yet

Exploits

No exploit reference

Common Weakness Enumeration

CWE-613 Insufficient Session Expiration

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

References

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High