UpHeron
All vulnerabilities

Servers and applications

CVE-2023-38489

Insufficient Session Expiration after a password change

Severity
High 7.3
Published
27 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
Also known as
GHSA-5mvj-rvp8-rf45
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be abused if a Kirby user is logged in on a device or browser that is shared with potentially untrusted users or if an attacker already maliciously used a previous…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • From 3.5.0 before 3.5.8.3
  • From 3.6.0 before 3.6.6.3
  • From 3.7.0 before 3.7.5.2
  • From 3.8.0 before 3.8.4.1
  • From 3.9.0 before 3.9.6
KirbyServers and applications · github:getkirby/kirby
  • From 3.9.0 before 3.9.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-38489
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-38489
  • GitHub Advisory Database https://github.com/advisories/GHSA-5mvj-rvp8-rf45
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-5mvj-rvp8-rf45