What is CVE-2021-25985?

CVE-2021-25985 is a high-severity vulnerability in Darwin Factor, classified under Insufficient Session Expiration. CVSS score: 7.8/10. Published 2021-11-16.

How severe is CVE-2021-25985?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Darwin Factor

CVE-2021-25985

In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.

EPSS: 0.008 (51.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Darwin Factor
Factorjs Factor — versions 1.0.4, unspecified

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

vulnerabilitylab@mend.io (x_refsource_MISC)
vulnerabilitylab@mend.io (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-25985?: CVE-2021-25985 is a high-severity vulnerability in Darwin Factor, classified under Insufficient Session Expiration. CVSS score: 7.8/10. Published 2021-11-16.
How severe is CVE-2021-25985?: High severity. CVSS v3 base score is 7.8 out of 10.