Insufficient Session Expiration in admidio/admidio
Reported on
Mar 9th 2022
Description
The application failed to invalidate the session after changing the password and In this scenario changing the password doesn't destroy the other sessions which are logged in with old passwords.
Proof of Concept
1.Login same account in two different browsers.
2.Try to change the password from one browser.
3.You will see after changing the password, sessions don't get destroyed from another browser and it is still logged in with old passwords.
Impact
If a user's account got compromised and he/she tried to change the password still after changing the password session will not destroy and the attacker will have control over the account.
References
You are welcome @maintainer @fasse. As admidio have many past CVE's: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=admidio @admin can you please register a CVE for this report?
Sure, we can assign a CVE, we just require permission from the maintainer before we proceed 👍
Yes you can create a CVE. We will release a fixed version today.
@admin Maintainer is agree so can you please register a CVE for this report?
CVE assigned! 👍
Once you have confirmed the fix, just give me a ping, and we will get the CVE published too.
@admin The fix has been deployed so can you please publish the CVE?