CVE-2025-28059

HIGH Year: 2025
CVSS v3 Score
7.5
High
Weakness Type
CWE-613
View all →

Vulnerability Description

An access control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows deleted users to retain access to system resources due to improper session invalidation and stale token handling. When an administrator deletes a user account, the backend fails to terminate active sessions and revoke associated API tokens, enabling unauthorized access to restricted functions.

Related Vulnerabilities

CVE-2016-11058

HIGH
CVSS:7.5(High)

The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs.

CWE-6132016

CVE-2016-20007

HIGH
CVSS:7.5(High)

The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.

CWE-6132016

CVE-2017-12159

HIGH
CVSS:7.5(High)

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible i...

CWE-6132017

CVE-2020-11688

HIGH
CVSS:7.5(High)

In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.

CWE-6132020

CVE-2020-11795

HIGH
CVSS:7.5(High)

In JetBrains Space through 2020-04-22, the session timeout period was configured improperly.

CWE-6132020

CVE-2020-24713

HIGH
CVSS:7.5(High)

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.

CWE-6132020