Apache Roller, an open-source blog server platform developed in the Java programming language, allows users and administrators to create, manage, and publish multiple personal or group blogs on the same server. Recently, on its website, Apache Roller announced a critical security vulnerability, scoring 10.0 on the CVSS 4.0 scale—the highest in severity, affecting all versions of Apache Roller up to and including 6.1.4. Below are the details:

Details

Vulnerability Identifier: CVE-2025-24859
CVSS Score (4.0): 10.0
Severity Level: Critical
Description: The vulnerability exists in the session management mechanism of Apache Roller. Specifically, after a user changes their password, the active sessions are not terminated, leading to a vulnerability that allows an attacker to use the current active session to log in and access the application without going through authentication.
Affected Versions: All versions prior to 6.1.5

CVE-2025-24859 is extremely critical because it can be easily exploited if an attacker already has the login information or has stolen a valid user session. It allows the attacker to maintain long-term access to the application, despite any changes the user makes to their login information. This results in security risks, unauthorized data access, and the potential for data theft and leakage of sensitive information.

Mitigation & Recommendations

In Apache Roller version 6.1.5, the development team has patched the vulnerability by implementing centralized session management. This mechanism ensures that active sessions are immediately terminated if a user changes their password or if the user account is disabled. Therefore, the FPT Threat Intelligence team recommends that users:

Update Apache Roller: Upgrade to version 6.1.5 and later to patch the vulnerability.
Manage Active Sessions: If you cannot immediately apply the patch, users and administrators should monitor and manage existing active sessions. Implement temporary measures to terminate active sessions when there is a change in the user's account status (such as a password change or account deactivation).
Regular Security Checks: Conduct regular security assessments to identify and address existing vulnerabilities in the system.
Enhance User Awareness: Increase user awareness about security in general. Additionally, users should strictly follow policies related to setting and regularly changing passwords, as well as reporting and terminating unusual login sessions in the application.

References

CVE Record: CVE-2025-24859

A critical vulnerability (CVSS 10.0) exists in Apache Roller

Comments

Newsletters-eng

More from this blog

Khi chiếc máy tính của bạn trở thành "trạm trung chuyển" bí mật cho gián điệp mạng

Dysphoria: sáu ngày sau cuộc triệt phá, và tám năm sau ý tưởng gốc

Operation BlueDash: khi RMM hợp pháp trở thành backdoor, và một repo GitHub công khai kể lại toàn bộ chiến dịch

Từ SSH Botnet Đến “Ổ” Đào Coin: Lần Theo Dấu Vết Một Chiến Dịch Cryptomining

OctLurk & SilkLurk: Hai Backdoor “Ẩn Mình” Và Tự Biến Đổi Theo Từng Nạn Nhân

Details

Mitigation & Recommendations

References

Command Palette

Comments

Newsletters-eng

More from this blog

Details

Mitigation & Recommendations

References