CVE-2025-63563
BaseFortify
Publication date: 2025-10-31
Last updated on: 2025-11-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| summerpearlgroup | vacation_rental_management_platform | to 1.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-286 | The product does not properly manage a user within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Insufficient Session Expiration issue in the Summer Pearl Group Vacation Rental Management Platform versions up to 1.0.1. When a user changes their password, the platform does not invalidate existing active sessions. This means that an attacker who has a valid session token can continue to access the user's account even after the password has been changed, leading to unauthorized access. [1]
How can this vulnerability impact me? :
The vulnerability allows an attacker with a valid session token to maintain access to a user's account even after the user changes their password. This can lead to unauthorized account access, potential data compromise, and loss of control over the affected account. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying whether active user sessions remain valid after a password change. Specifically, you can test by logging in with a user account, capturing the session token, changing the password for that account, and then attempting to use the old session token to access the account. If access is still granted, the vulnerability exists. There are no specific commands provided in the resources, but this manual test involves session token inspection and validation after password changes. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Summer Pearl Group Vacation Rental Management Platform to version 1.0.2 or later, where the issue of insufficient session expiration after password changes has been fixed. Until the upgrade is applied, consider enforcing manual session invalidation policies or monitoring for suspicious session reuse after password changes. [1]