Is CVE-2021-25979 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-25979 being exploited in the wild.

How severe is CVE-2021-25979?

Low severity, with a CVSS score of 3.1, published 10 November 2021.

Which products and versions are affected?

Apostrophe CMS 2.63.0 to 3.3.1; apostrophe (npm) SEMVER:introduced=2.63.0,fixed=3.4.0.

Is there a fix for CVE-2021-25979?

Yes. apostrophe (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-25979 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-25979?

Check whether you run Apostrophe CMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-25979: Apostrophe CMS insufficient session expiration

CVE-2021-25979 · Severity: low · CVSS 3.1 · Published 2021-11-10

Apostrophe CMS is a Node.js-based content management system used to build and manage websites. A flaw in session management allows unauthenticated attackers to hijack the sessions of users who have recently logged in, potentially gaining unauthorized access to administrative functions and website content. This could allow an attacker to take control of the site or access sensitive data without needing valid credentials.

Technologies: Apostrophe CMS, apostrophe (npm). Vendors: Apostrophe, npm.

Quick answers

Is CVE-2021-25979 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-25979 being exploited in the wild.
How severe is CVE-2021-25979?: Low severity, with a CVSS score of 3.1, published 10 November 2021.
Which products and versions are affected?: Apostrophe CMS 2.63.0 to 3.3.1; apostrophe (npm) SEMVER:introduced=2.63.0,fixed=3.4.0.
Is there a fix for CVE-2021-25979?: Yes. apostrophe (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-25979 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-25979?: Check whether you run Apostrophe CMS or apostrophe (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apostrophe (npm): upgrade to 3.4.0 or later
```
npm install apostrophe@3.4.0
```

Technical details

Apostrophe CMS versions 2.63.0 through 3.3.1 fail to properly expire user sessions after logout or account inactivity, violating CWE-613 (Insufficient Session Expiration). The vulnerability allows unauthenticated remote attackers to reuse or hijack session tokens of recently logged-in users via network access. No authentication or user interaction is required to exploit this. An attacker can achieve full session takeover, accessing admin functionality with the privileges of the hijacked account. The issue was fixed in version 3.4.0; for older versions, archiving (3.x) or moving an account to trash (2.x) disables existing sessions as a workaround.

Affected products

Apostrophe Apostrophe CMS 2.63.0 to 3.3.1

Identifiers

CVE-2021-25979
GHSA-9j9m-8wjc-ff96

Timeline

2021-11-10: disclosed
2021-11-10: patched: Fixed in version 3.4.0

References

https://github.com/apostrophecms/apostrophe/commit/c211b211f9f4303a77a307cf41aac9b4ef8d2c7c

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.