CVE-2025-53642

haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg	Third Party Advisory Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:psu:haxcms-nodejs::::::node.js::*
	cpe:2.3:a:psu:haxcms-php::::::::

History

No history.

Information

Published : 2025-07-11 18:15

Updated : 2025-08-22 16:52

NVD link : CVE-2025-53642

Mitre link : CVE-2025-53642

CVE.ORG link : CVE-2025-53642

JSON object : View

Products Affected

psu

haxcms-nodejs
haxcms-php

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-53642", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-07-11T18:15:35.123", "references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg", "tags": ["Third Party Advisory", "Issue Tracking"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6."}, {"lang": "es", "value": "haxcms-nodejs y haxcms-php son backends para HAXcms. La funci\u00f3n de cierre de sesi\u00f3n de la aplicaci\u00f3n no cierra la sesi\u00f3n del usuario ni borra sus cookies. Adem\u00e1s, la aplicaci\u00f3n emite un token de actualizaci\u00f3n al cerrar sesi\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 11.0.6."}], "lastModified": "2025-08-22T16:52:08.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C760A93C-A6C5-457F-9913-4CFFBC00E20E", "versionEndExcluding": "11.0.6"}, {"criteria": "cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17EB8163-34F7-4A85-BC57-B0050F8A2AA6", "versionEndExcluding": "11.0.6"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}