CVE-2025-24859
Apache Roller: Insufficient Session Expiration on Password Change
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Apache Roller: Insufficient Session Expiration on Password Change
A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.
Reserved 2025-01-26 | Published 2025-04-14 | Updated 2025-04-18 | Assigner apacheimportant
CWE-613 Insufficient Session Expiration
Haining Meng
lists.apache.org/thread/vxv52vdr8nhtjlj6v02w43fdvo0cxw23
lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f
Support options
