CVE-2019-5638

CVE-2019-5638 describes an insufficient session expiration vulnerability in Rapid7 Nexpose versions 6.5.50 and earlier. This flaw allows a user's active session to remain valid even after an administrator changes their password, potentially enabling an attacker with compromised credentials to maintain access. Rated with a CVSS score of 8.7 (HIGH), the vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality and integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.