Apache Roller up to 6.1.4 session expiration

Summaryinfo

A vulnerability marked as critical has been reported in Apache Roller up to 6.1.4. Affected is an unknown function. This manipulation causes session expiration. This vulnerability is tracked as CVE-2025-24859. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Roller up to 6.1.4. It has been declared as critical. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a session expiration vulnerability. The CWE definition for the vulnerability is CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.

It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2025-24859 since 01/26/2025. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 276820 (Apache Roller < 6.1.5 Insufficient Session Expiration on Password Change (CVE-2025-24859)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.1.5 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (276820) and EUVD (EUVD-2025-10872). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Roller

Version

• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion