title: ArangoDB - Insufficient Session Expiration after Password Change
description: In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.
problem types: CWE-613 Insufficient Session Expiration
affected:
{
product: arangodb
vendor: arangodb
versions:
lessThan: unspecified, status: affected, version: v3.7.6, versionType: custom
lessThanOrEqual: v3.8.3, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update to v3.9.0-alpha.1 or later