High severity · published Apr 9, 2025
CVE-2025-1968
Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay…
7.7
CVSS
0.3%
EPSS
No
On KEV
Description
Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Sitefinity · Progress Software Corporation
14.0 through 14.3; 14.4 before 14.4.8145; 15.0 before 15.0.8231; 15.1 before 15.1.8332; 15.2 before 15.2.8429 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-1968
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-1968
community.progress.com
https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025
More from Sitefinity
6.5
CVE-2024-1632
Incorrect access control in the Sitefinity backend
5.4
CVE-2024-1636
Potential Cross-Site Scripting (XSS) in the page editing area
5.3
CVE-2024-11625
Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from 4.0 through 14.4.8142, from 15.0.8200…
5.3
CVE-2024-4882
URL Redirection to Arbitrary Site Exists in Sitefinity
4.8
CVE-2024-11626
Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue…