CVE-2025-59335: CubeCart Session Not Invalidated After Password Change
CubeCart is an ecommerce software solution. Prior to version 6.5.11, there is an absence of automatic session expiration following a user's password change. This oversight poses a security risk, as if a user forgets to log out from a location where they accessed their account, an unauthorized user can maintain access even after the password has been changed. Due to this bug, if an account has already been compromised, the legitimate user has no way to revoke the attacker’s access. The malicious actor retains full access to the account until their session naturally expires. This means the account remains insecure even after the password has been changed. This issue has been patched in version 6.5.11.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59335?
CVE-2025-59335 is considered a high-severity vulnerability due to the risk of unauthorized access after a password change.
How do I fix CVE-2025-59335?
To mitigate CVE-2025-59335, upgrade CubeCart to version 6.5.11 or later, which implements automatic session expiration after password changes.
What impact does CVE-2025-59335 have on my CubeCart installation?
CVE-2025-59335 allows potential attackers to maintain access to a user's account if they do not log out after a password change, increasing the risk of account compromise.
Who is affected by CVE-2025-59335?
CVE-2025-59335 affects all users of CubeCart versions prior to 6.5.11.
Is there a workaround for CVE-2025-59335 if I cannot upgrade?
There are no known effective workarounds for CVE-2025-59335, so upgrading is strongly recommended.