CVE-2025-65681

Vulnerability

Overview

CVE-2025-65681 affects Overhang.IO Tutor (tutor-open-edx) version 20.0.2, a Docker-based Open edX distribution [2][3]. The vulnerability stems from the absence of proper cache-control HTTP headers and inadequate client-side session checks, allowing sensitive user information to remain accessible after logout [1][1][4].

Exploitation

Details

A local unauthorized attacker with access to a victim's browser session can exploit this flaw by simply pressing the browser's back button after the victim logs out [4]. The attack requires no special privileges beyond physical or local access to the same machine and browser [1]. The lack of cache-control headers means the browser retains previously loaded pages in its history cache, while missing client-side session checks fail to invalidate the user's authenticated state [4].

Impact

Successful exploitation exposes personally identifiable information (PII) and other sensitive account details that were visible on the account settings page [4]. This information disclosure violates user privacy and compromises session integrity, as the attacker can view data without reauthentication [4].

Mitigation

As of the publication date, no patch has been announced for this vulnerability. The vendor's documentation and source code repository are available for tracking updates [2][3]. Users should consider implementing additional cache-control headers and enforcing client-side session validation on cached pages as a workaround until an official fix is released.