CVE-2025-1968

Status: DeferredHigh (7.7)—

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Base score: 7.7

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.32%
Percentile among all scored CVEs: 23
Score date: 10/4/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access75 %
Primary impactT1078 Valid Accountsstealth · persistence · privilege escalation · initial access80 %
Secondary impactT1565 Data Manipulationimpact65 %

Vulnerabilidad remota sin autenticación (AV:N/PR:N) en aplicación web (Sitefinity). CWE-613 permite reutilización de sesiones (session replay), comprometiendo autenticación y acceso a datos/funcionalidades del usuario.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Network Segmentation Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Progress — Sitefinity^AI

CWEs

CWE-613

References

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025

Raw JSON (NVD)

Show

{
  "id": "CVE-2025-1968",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1968",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-10T03:55:30.253793Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@progress.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@progress.com",
      "affectedData": [
        {
          "vendor": "Progress Software Corporation",
          "product": "Sitefinity",
          "versions": [
            {
              "status": "affected",
              "version": "14.0",
              "versionType": "custom",
              "lessThanOrEqual": "14.3"
            },
            {
              "status": "affected",
              "version": "14.4",
              "lessThan": "14.4.8145",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.0",
              "lessThan": "15.0.8231",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.1",
              "lessThan": "15.1.8332",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "15.2",
              "lessThan": "15.2.8429",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-09T14:15:27.950",
  "references": [
    {
      "url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025",
      "source": "security@progress.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@progress.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de expiración de sesión insuficiente en Progress Software Corporation Sitefinity en algunas circunstancias específicas y poco comunes permite reutilizar los ID de sesión (ataques de reproducción de sesión). Este problema afecta a Sitefinity: desde la versión 14.0 hasta la 14.3, desde la versión 14.4 hasta la 14.4.8145, desde la versión 15.0 hasta la 15.0.8231, desde la versión 15.1 hasta la 15.1.8332, desde la versión 15.2 hasta la 15.2.8429."
    }
  ],
  "lastModified": "2026-06-17T08:40:27.193",
  "sourceIdentifier": "security@progress.com"
}