BIT-arangodb-2021-25940
Dashboard / Vulnerabilities / BIT-arangodb-2021-25940
Summary: ArangoDB - Insufficient Session Expiration after Password Change
Details: In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.
References: https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3, https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25940, https://nvd.nist.gov/vuln/detail/CVE-2021-25940
Affected packages
Package
Name: arangodb
Purl: pkg:bitnami/arangodb
Affected ranges
Type: SEMVER
Events:
Introduced- 3.7.6
Fixed -3.8.4
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
