CVE-2021-25985: falha de alta gravidade em FactorJS Factor
FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.8%
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
FactorJS · FactorCVEs relacionadas — FactorJS Factor
No mesmo produto, das mais perigosas para as menos.
CVE-2021-25982MEDIUMFactorJS - Reflected Cross-Site Scripting (XSS) in Search FunctionalityEPSS 0.8%CVE-2021-25984MEDIUMFactorJS - Stored Cross-Site Scripting (XSS) in Post Reply FunctionalityEPSS 0.7%CVE-2021-25983MEDIUMFactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories FunctionalityEPSS 0.7%