CVE-2021-25985: FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25985?
CVE-2021-25985 has a severity rating that indicates a high risk due to session management issues.
How do I fix CVE-2021-25985?
To fix CVE-2021-25985, ensure that user sessions are properly invalidated upon logout and consider implementing session expiration.
What versions of Factor are affected by CVE-2021-25985?
CVE-2021-25985 affects Factor versions from 1.0.4 up to 1.8.30.
What are the consequences of CVE-2021-25985?
The consequences of CVE-2021-25985 include the risk of unauthorized access to user sessions even after logout.
Is CVE-2021-25985 related to local storage security?
Yes, CVE-2021-25985 involves security issues regarding user sessions being stored in the browser's local storage, which lacks expiration.