Security readout for executives and security teams
Plain-English summary
CVE-2021-25940 means some ArangoDB sessions can remain valid after an administrator changes a user password. A former or malicious user who already has a session may keep access and act with that account’s permissions. This weakens password reset as an incident response control.
Executive priority
Prioritize remediation where ArangoDB supports production, sensitive data, or privileged workflows. The main business risk is that removing access by changing a password may not immediately remove an already-open session.
Technical view
ArangoDB v3.7.6 through v3.8.3 is reported vulnerable to CWE-613, insufficient session expiration. The CVSS 3.1 score is 8.8, with network attack vector and low privileges required. The issue concerns failure to invalidate existing sessions after administrator-driven password changes.
Likely exposure
Exposure is most likely in ArangoDB deployments running v3.7.6 through v3.8.3, especially where the web/API interface is reachable and password changes are used to contain user risk. Evidence for other versions is not provided in the bundle.
Exploitation context
The bundle says a logged-in malicious user could continue using an existing session after an admin password change. It does not include KEV listing or cited evidence of active exploitation in the wild.
Researcher notes
The evidence identifies CWE-613 behavior and a referenced ArangoDB commit, but the bundle does not name a fixed release or provide exploit-in-the-wild confirmation. Validation should focus on version exposure, session behavior after admin password changes, and vendor-confirmed remediation.
Mitigation direction
- Identify ArangoDB instances and compare versions against v3.7.6 through v3.8.3.
- Check ArangoDB guidance and release notes for the vendor-supported fixed version.
- Upgrade to a supported release containing or superseding the referenced fix.
- Treat password reset alone as insufficient containment on affected systems.
- Restrict access to ArangoDB administrative interfaces where operationally possible.
Validation and detection
- Review asset inventory for ArangoDB deployments and exposed management endpoints.
- Confirm whether deployed versions fall within the stated affected range.
- Review password-change procedures for reliance on automatic session invalidation.
- Check logs for continued activity after administrative password changes.
- Verify remediation against vendor release notes or the referenced commit.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-613: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-25940 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/arangodb/arangodb/commit/e9c6ee9dcca7b9b4fbcd02a0b323d205bee838d3CVE reference · x_refsource_MISC
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25940CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Session Expiration
Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.