CVE-2025-59335
BaseFortify
Publication date: 2025-09-22
Last updated on: 2025-09-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cubecart | cubecart | to 6.5.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in CubeCart versions prior to 6.5.11 occurs because user sessions are not automatically invalidated after a password change. This means if an attacker has already gained access to a user's account and the user changes their password, the attacker can still maintain access through the existing session without needing to re-authenticate. The legitimate user cannot revoke this unauthorized access by simply changing their password, leaving the account insecure until the session naturally expires. [1]
How can this vulnerability impact me? :
The vulnerability allows an attacker who has compromised an account to maintain unauthorized access even after the legitimate user changes their password. This means the attacker can continue to perform actions on the account without interruption, potentially leading to data theft, unauthorized transactions, or other malicious activities. The legitimate user has no immediate way to revoke the attacker's access, increasing the risk of prolonged account compromise. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if user sessions remain active after a password change. One practical method is to log into the same account on two different browsers or devices, change the password on one, and verify if the other session remains active without requiring re-authentication. There are no specific network or system commands provided to detect this vulnerability automatically. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade CubeCart to version 6.5.11 or later, where the issue is patched. The patch enforces automatic logout of users upon password changes, invalidating existing sessions. If upgrading is not immediately possible, manually logging out all sessions after a password change can help reduce risk. Additionally, inform users to log out from all devices after changing their password until the patch is applied. [2, 3]