Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

GHSA-377j-wj38-4728 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceGHSA-377j-wj38-4728

GHSA-377j-wj38-4728

LOW2.1

Weblate has a long session expiry when verifying second factor

Published Sep 4, 2025

Modified 1 years ago

Fix available

Details

Impact

The verification of the second factor had too long a session expiry. The long session expiry could be used to circumvent rate limiting of the second factor.

Patches

This issue has been addressed in Weblate 5.13.1 via https://github.com/WeblateOrg/weblate/pull/16002.

References

Thanks to Nahid Hasan Limon for reporting this issue responsibly.

Affected Packages

Weblate

PyPI

Fixed in:

5.13.1

References

PACKAGE

https://github.com/WeblateOrg/weblate

WEB

https://github.com/WeblateOrg/weblate/commit/0b46fe596231dd456283ead66699ae5516f23908

WEB

https://github.com/WeblateOrg/weblate/pull/16002

WEB

https://github.com/WeblateOrg/weblate/security/advisories/GHSA-377j-wj38-4728

ADVISORY

https://github.com/advisories/GHSA-377j-wj38-4728

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2025-58352

Aliases

CVE-2025-58352

CVSS Analysis

CVSS v4.0

2.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Attack Requirements

PresentAT:P

Privileges Required

LowPR:L

User Interaction

PassiveUI:P

Vulnerable System

Vuln. Confidentiality

LowVC:L

Vuln. Integrity

LowVI:L

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

2.1/CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVE-2025-58352

Ecosystems

PyPI

Timeline

PublishedSep 4, 2025

ModifiedSep 5, 2025