Vulnerabilities > CVE-2021-37156 - Insufficient Session Expiration vulnerability in Redmine 4.2.0/4.2.1
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |