CVE-2025-1968

published 2025-04-09

CVE-2025-1968: Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session…

Priority P3 44 high 7.7 CVSS 3.1

AV N AC H PR N UI N S U C H I H A L

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
progress_software_corporation	sitefinity	14.0 – 14.3	—
progress_software_corporation	sitefinity	>= 14.4 < 14.4.8145	14.4.8145
progress_software_corporation	sitefinity	>= 15.0 < 15.0.8231	15.0.8231
progress_software_corporation	sitefinity	>= 15.1 < 15.1.8332	15.1.8332
progress_software_corporation	sitefinity	>= 15.2 < 15.2.8429	15.2.8429

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-613