CVE-2024-25628: Insufficient Session Expiration in alf.io
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alf.ioto a version that resolves this vulnerability.Fixed in 2.0-M4-2402
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25628?
CVE-2024-25628 has a medium severity rating as it allows unauthorized access to the admin area.
How do I fix CVE-2024-25628?
To resolve CVE-2024-25628, upgrade to Alf.io version 2.0-M4-2402 or later.
What versions of Alf.io are affected by CVE-2024-25628?
CVE-2024-25628 affects all Alf.io versions prior to 2.0-M4-2402.
What risk does CVE-2024-25628 pose to my application?
CVE-2024-25628 poses a risk of unauthorized access to the admin area, potentially compromising sensitive data.
Is there a workaround for CVE-2024-25628?
There are no known workarounds for CVE-2024-25628; upgrading is the recommended action.