CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-25940

In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 50.5%

CVSS Severity

CVSS v3 Score 8.8

CVSS v2 Score 6.0

References

Products affected by CVE-2021-25940

Arangodb » Arangodb » Version: 3.7.10

cpe:2.3:a:arangodb:arangodb:3.7.10
Arangodb » Arangodb » Version: 3.7.11

cpe:2.3:a:arangodb:arangodb:3.7.11
Arangodb » Arangodb » Version: 3.7.12

cpe:2.3:a:arangodb:arangodb:3.7.12
Arangodb » Arangodb » Version: 3.7.13

cpe:2.3:a:arangodb:arangodb:3.7.13
Arangodb » Arangodb » Version: 3.7.13.1

cpe:2.3:a:arangodb:arangodb:3.7.13.1
Arangodb » Arangodb » Version: 3.7.14

cpe:2.3:a:arangodb:arangodb:3.7.14
Arangodb » Arangodb » Version: 3.7.15

cpe:2.3:a:arangodb:arangodb:3.7.15
Arangodb » Arangodb » Version: 3.7.6

cpe:2.3:a:arangodb:arangodb:3.7.6
Arangodb » Arangodb » Version: 3.7.6.1

cpe:2.3:a:arangodb:arangodb:3.7.6.1
Arangodb » Arangodb » Version: 3.7.7

cpe:2.3:a:arangodb:arangodb:3.7.7
Arangodb » Arangodb » Version: 3.7.8

cpe:2.3:a:arangodb:arangodb:3.7.8
Arangodb » Arangodb » Version: 3.7.9

cpe:2.3:a:arangodb:arangodb:3.7.9
Arangodb » Arangodb » Version: 3.8.0

cpe:2.3:a:arangodb:arangodb:3.8.0
Arangodb » Arangodb » Version: 3.8.1

cpe:2.3:a:arangodb:arangodb:3.8.1
Arangodb » Arangodb » Version: 3.8.2

cpe:2.3:a:arangodb:arangodb:3.8.2
Arangodb » Arangodb » Version: 3.8.3

cpe:2.3:a:arangodb:arangodb:3.8.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-25940

Products

Pricing

Contact Us