CVE-2021-25985

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-25985
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25985.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-25985
Published
2021-11-16T10:15:07Z
Modified
2026-09-06T08:09:16Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.

References

Affected packages

Git / github.com/fictionco/fiction

Affected ranges

Type
GIT
Repo
https://github.com/fictionco/fiction
Events
Introduced
21a157473c6a987072b320ba482d16d1ae7e2ce2
Last Affected
ff33a72ef8106e8ab60ef933f4b72e1f359d5d7c
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:darwin:factor:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.4"
        },
        {
            "last_affected": "1.8.30"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25985.json"