Vulnerability · Published Apr 9, 2025 · Assigned by ProgressSoftware

CVE-2025-1968

High 7.7

In plain English

A high-severity security flaw in Sitefinity from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 73.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.

Affected products (as reported)

Vendor	Product	Versions
Progress Software Corporation	Sitefinity	14.0 – through 14.314.4 – before 14.4.814515.0 – before 15.0.823115.1 – before 15.1.833215.2 – before 15.2.8429

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

References

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025