CVE-2023-38489

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config. It can only be abused if a Kirby user is logged in on a device or browser th...

CVE-2023-38489

CVE-2023-38489 – Kirby Insufficient Session Expiration (modeled across multiple sources) Kirby CMS versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 are affected. The vulnerability arises because old sessions were not invalidated when a user’s password was changed, allowing a previo...