{"id":"CVE-2021-25940","details":"In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.","aliases":["BIT-arangodb-2021-25940"],"modified":"2026-05-15T09:50:55.133427Z","published":"2021-11-16T10:15:06.783Z","references":[{"type":"ADVISORY","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25940"},{"type":"FIX","url":"https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/arangodb/arangodb","events":[{"introduced":"780ac0e1272d8fcebe2ed36c0e2cbaf336f0d207"},{"last_affected":"7a9a07d06a0d9750103c93eb3caa9eda8e782b72"}],"database_specific":{"extracted_events":[{"introduced":"3.7.6"},{"last_affected":"3.8.3"}],"source":"CPE_FIELD","cpe":"cpe:2.3:a:arangodb:arangodb:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-25940.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}