CVE-2025-53642

haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg	Third Party Advisory Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:psu:haxcms-nodejs::::::node.js::*
	cpe:2.3:a:psu:haxcms-php::::::::

History

22 Aug 2025, 16:52

Type	Values Removed	Values Added
First Time		Psu haxcms-php Psu Psu haxcms-nodejs
References	~~() https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg -~~	() https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg - Third Party Advisory, Issue Tracking
CPE		cpe:2.3:a:psu:haxcms-php:::::::: cpe:2.3:a:psu:haxcms-nodejs::::::node.js::*

15 Jul 2025, 13:14

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 18:15

Updated : 2025-08-22 16:52

NVD link : CVE-2025-53642

Mitre link : CVE-2025-53642

CVE.ORG link : CVE-2025-53642

JSON object : View

Products Affected

psu

haxcms-nodejs
haxcms-php

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-53642", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-07-11T18:15:35.123", "references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg", "tags": ["Third Party Advisory", "Issue Tracking"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6."}, {"lang": "es", "value": "haxcms-nodejs y haxcms-php son backends para HAXcms. La funci\u00f3n de cierre de sesi\u00f3n de la aplicaci\u00f3n no cierra la sesi\u00f3n del usuario ni borra sus cookies. Adem\u00e1s, la aplicaci\u00f3n emite un token de actualizaci\u00f3n al cerrar sesi\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 11.0.6."}], "lastModified": "2025-08-22T16:52:08.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C760A93C-A6C5-457F-9913-4CFFBC00E20E", "versionEndExcluding": "11.0.6"}, {"criteria": "cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17EB8163-34F7-4A85-BC57-B0050F8A2AA6", "versionEndExcluding": "11.0.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}