CVE-2019-7215 Security feature bypass in n/a
Attackers can maintain unauthorized access to user accounts after logout because session cookies remain valid on the server side.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7215?
CVE-2019-7215 is a medium-severity vulnerability in n/a, published on 6 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie in the browser, but it remains valid on the server side. This means the cookie can be reused to maintain access to the account, even if the account credentials and permissions are changed.
Weakness: CWE-613
Which versions are affected by CVE-2019-7215?
It affects 1 product.
Products include Progress Sitefinity.
How do I fix CVE-2019-7215?
No fix has been published for CVE-2019-7215 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-7215 being exploited?
There is no known exploitation of CVE-2019-7215 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-9248 Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness
- CVE-2026-7312 CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity
- CVE-2026-7198 CWE-284: Improper Access Control in web services in Progress Sitefinity
- CVE-2023-29375 File upload in n/a
- CVE-2019-17392 Auth bypass in n/a
Sources
Also known as GHSA-74xh-52qm-qf5r.