← Vulnerability feed

Vulnerability record · CVE-2025-24859 · published 14 April 2025

CVE-2025-24859: Apache roller insufficient session expiration vulnerability

Apache · Roller

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.

2.1 CVSS 4.0 Low EPSS 1.1% · top 35.3% CWE-613 · Insufficient session expiration
2.1CVSS 4.0 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f Release Notes
https://lists.apache.org/thread/vxv52vdr8nhtjlj6v02w43fdvo0cxw23 Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/04/11/1 Mailing List

Track CVE-2025-24859 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-17198Apache roller server-side request forgery (ssrf) vulnerabilityServer-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier unsupported versions relies on Java S…EPSS 4.1%9.8CVE-2014-0030Apache roller xml external entity (xxe) vulnerabilityThe XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.EPSS 17%7.5CVE-2021-33580Apache roller uncontrolled resource consumption vulnerabilityUser controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression…EPSS 3.3%7.2CVE-2015-0249Apache roller code injection vulnerabilityThe weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary…EPSS 4.6%6.8CVE-2013-4212Apache Roller OGNL injection in ActionSupport getText methodsApache Roller before 5.0.2 passes attacker-controlled parameters into OGNL expressions inside certain getText methods of the ActionSupport controller…EPSS 81%analysed6.8CVE-2012-2380Apache roller cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack…EPSS 1.6%6.1CVE-2019-0234Apache roller cross-site scripting vulnerabilityA Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user inpu…EPSS 3.4%5.4CVE-2024-25090Apache roller improper input validation vulnerabilityInsufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of …EPSS 0.75%

Source: NIST National Vulnerability Database (record CVE-2025-24859), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.