CVE-2025-1968 — Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429

Back Back to CVE browser

HIGH

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429

Published Apr 9, 2025

7.7

HIGH

CVSS 3.1

EPSS 0.32%

Description

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.1.8332, from 15.2 before 15.2.8429.

Affected products

Vendor Progress Software Corporation Product Sitefinity Default
unaffected
- Version
  14.0
  Status
  affected
  Constraints
  <=14.3
- Version
  14.4
  Status
  affected
  Constraints
  <14.4.8145
- Version
  15.0
  Status
  affected
  Constraints
  <15.0.8231
- Version
  15.1
  Status
  affected
  Constraints
  <15.1.8332
- Version
  15.2
  Status
  affected
  Constraints
  <15.2.8429

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress Software Corporation

Sitefinity

unaffected

Version	Status	Constraints
14.0	affected	<=14.3
14.4	affected	<14.4.8145
15.0	affected	<15.0.8231
15.1	affected	<15.1.8332
15.2	affected	<15.2.8429

Remediation

No remediation recorded yet.

Metrics

0.32% 0.00318

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00318

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.32% (0.00318)	22.42th	v5 (v2026.06.15)
Jun 15, 2026	0.26% (0.00260)	17.09th	v5 (v2026.06.15)
Apr 10, 2025	0.04% (0.00040)	9.22th	v4 (v2025.03.14)

Weaknesses (1)

CWE-613

References (1)

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025

Link	Providers	Tags
https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerability-CVE-2025-1968-April-2025

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ProgressSoftware

Published Apr 9, 2025

Updated Feb 26, 2026

Reserved Mar 4, 2025

Link CVE-2025-1968

CISA Vulnrichment

Updated Apr 10, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-1968

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-1968