CVE-2025-53642

haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg	Third Party Advisory Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:psu:haxcms-nodejs::::::node.js::*
	cpe:2.3:a:psu:haxcms-php::::::::

History

22 Aug 2025, 16:52

Type	Values Removed	Values Added
References	~~() https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg -~~	() https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg - Third Party Advisory, Issue Tracking
First Time		Psu haxcms-php Psu haxcms-nodejs Psu
CPE		cpe:2.3:a:psu:haxcms-php:::::::: cpe:2.3:a:psu:haxcms-nodejs::::::node.js::*

15 Jul 2025, 13:14

Type	Values Removed	Values Added
Summary		(es) haxcms-nodejs y haxcms-php son backends para HAXcms. La función de cierre de sesión de la aplicación no cierra la sesión del usuario ni borra sus cookies. Además, la aplicación emite un token de actualización al cerrar sesión. Esta vulnerabilidad se corrigió en la versión 11.0.6.

11 Jul 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 18:15

Updated : 2025-08-22 16:52

NVD link : CVE-2025-53642

Mitre link : CVE-2025-53642

CVE.ORG link : CVE-2025-53642

JSON object : View

Products Affected

psu

haxcms-php
haxcms-nodejs

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-53642", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-07-11T18:15:35.123", "references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg", "tags": ["Third Party Advisory", "Issue Tracking"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6."}, {"lang": "es", "value": "haxcms-nodejs y haxcms-php son backends para HAXcms. La funci\u00f3n de cierre de sesi\u00f3n de la aplicaci\u00f3n no cierra la sesi\u00f3n del usuario ni borra sus cookies. Adem\u00e1s, la aplicaci\u00f3n emite un token de actualizaci\u00f3n al cerrar sesi\u00f3n. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 11.0.6."}], "lastModified": "2025-08-22T16:52:08.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:psu:haxcms-nodejs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C760A93C-A6C5-457F-9913-4CFFBC00E20E", "versionEndExcluding": "11.0.6"}, {"criteria": "cpe:2.3:a:psu:haxcms-php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17EB8163-34F7-4A85-BC57-B0050F8A2AA6", "versionEndExcluding": "11.0.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}