Progress Sitefinity Insufficient Session Expiration Vulnerability Allowing Session Replay Attacks

A vulnerability allowing session replay attacks has been identified in Progress Sitefinity versions 14.0 through 14.3, 14.4 prior to 14.4.8145, 15.0 prior to 15.0.8231, 15.1 prior to 15.1.8332, and 15.2 prior to 15.2.8429. This issue arises from insufficient session expiration in certain administrative views, under specific and uncommon circumstances, which allows for the reuse of Session IDs.

Impact

The vulnerability could lead to unauthorized reuse of session IDs, allowing for session replay attacks where an attacker could impersonate a user by reusing a valid session ID.

Remediation

Progress Sitefinity has released patches for all supported versions. Users are advised to update to the latest version. For instructions on how to apply the update, refer to the Progress Sitefinity Knowledge Base Article on updating Sitefinity to a patch.