Camaleon CMS Insufficient Session Expiration vulnerability

高 8.8CVE-2021-25970 · GHSA-438x-2p9v-g8h9 · 20/10/2021 公開 · 17/06/2026 更新

要点

CVE-2021-25970 は camaleon_cms, camaleon cms (tuzitio) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.3%（全脆弱性の 70.6% より高い）。
対処：2.6.0.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
camaleon_cms RubyGems	`≥ 0.1.7, < 2.6.0.1`	`2.6.0.1`
camaleon cms tuzitio	`≥ 0.1.7, ≤ 2.6.0`	修正版なし

概要

Camaleon CMS 0.1.7 through 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed. Resolved in commit 77e31bc6cdde7c951fba104aebcd5ebb3f02b030 which is included in the 2.6.0.1 release.

NVD の説明

Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.