Vulnerabilities > CVE-2021-25981 - Insufficient Session Expiration vulnerability in Talkyard

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
talkyard
CWE-613
critical
NVD
Published: 2022-01-03
Updated: 2024-11-21

Summary

In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)

Vulnerable Configurations

Part Description Count
Application
Talkyard
1

Common Weakness Enumeration (CWE)

References