EUVD-2021-0537

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

An old session ID can be reactivated after a new login, risking authentication security to an attacker.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2021-3311	5 Feb 202116:35	–	circl
CNNVD	Octobercms Code Issues Vulnerabilities	5 Feb 202100:00	–	cnnvd
CVE	CVE-2021-3311	5 Feb 202104:47	–	cve
Cvelist	CVE-2021-3311	5 Feb 202104:47	–	cvelist
Github Security Blog	October CMS Session ID not invalidated after logout	10 Feb 202102:32	–	github
NVD	CVE-2021-3311	5 Feb 202114:15	–	nvd
OSV	GHSA-7GGW-H8PP-R95R October CMS Session ID not invalidated after logout	10 Feb 202102:32	–	osv
Prion	Authentication flaw	5 Feb 202114:15	–	prion
RedhatCVE	CVE-2021-3311	22 May 202521:29	–	redhatcve
Veracode	Insecure Session Management	11 Feb 202103:57	–	veracode

[
  {
    "enisaIdVendor": [
      {
        "id": "4e363cdf-41ca-3d7d-a34c-8b9bca5e60e1",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "c1e58b59-e368-3a81-9087-c580224fbf35",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
github	www.github.com/octobercms/october/security/advisories/GHSA-7ggw-h8pp-r95r
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3311
github	www.github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024
anisiosantos	www.anisiosantos.me/october-cms-token-reactivation
octobercms	www.octobercms.com/forum/chan/announcements
packagist	www.packagist.org/packages/october/rain
cve	www.cve.circl.lu/cve/CVE-2021-3311
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

9.2High risk

Vulners AI Score9.2

CVSS 3.19.8

CVSS 26.8

EPSS0.01522