CVE-2024-39809 — Insufficient Session Expiration in F5 Big-ip Next Central Manager

CWE-613 — Insufficient Session Expiration4 documents4 sources
Severity
8.9HIGHNVD
EPSS
0.8%
top 25.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
F5 Big-ip Next Central Manager
Timeline
PublishedAug 14

Description

The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Packages2 packages

▶CVEListV5f5/big-ip_next_central_manager20.1.0 — 20.2.0

🔴Vulnerability Details

2
GHSA
GHSA-pvj4-5rhw-5cww: The Central Manager user session refresh token does not expire when a user logs out↗2024-08-14
▶
CVEList
BIG-IP Next Central Manager vulnerability↗2024-08-14
▶

📋Vendor Advisories

1
F5
CVE-2024-39809: The Central Manager user session refresh token does not expire when a user logs out↗2024-08-14
▶
CVE-2024-39809 — Insufficient Session Expiration in F5 | cvebase