Home

Description

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.

PUBLISHED Reserved 2025-03-04 | Published 2025-04-09 | Updated 2026-02-26 | Assigner ProgressSoftware




HIGH: 7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Problem types

CWE-613: Insufficient Session Expiration

Product status

Default status
unaffected

14.0 (custom)
affected

14.4 (custom) before 14.4.8145
affected

15.0 (custom) before 15.0.8231
affected

15.1 (custom) before 15.1.8332
affected

15.2 (custom) before 15.2.8429
affected

References

community.progress.com/...erability-CVE-2025-1968-April-2025

cve.org (CVE-2025-1968)

nvd.nist.gov (CVE-2025-1968)

Download JSON