| Package | Affected versions | Patched versions |
|---|---|---|
| apostrophecms | ≥ 2.63.0, < 3.3.1 | 3.3.1 |
| apostrophe | ≥ 2.63.0, < 3.4.0 | 3.4.0 |
Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free