The UI Performs the Wrong Action in collectiveaccess/providence

Valid

Reported on

Sep 27th 2021


Description

Sensitive Data can be exposed even after logouting the application due to ui wrong action

Proof of Concept

1) login to the application dashboard ( https://demo.collectiveaccess.org )
2)  Goto Any pages ( dashboard,administrations etc )
3) Click logout
4) Click browser back button

Impact

Any other user can view the data if browser tab remains unclosed. application must striclty redirect to login page even browser back button is pressed,

We have contacted a member of the collectiveaccess/providence team and are waiting to hear back a year ago
CollectiveAccess confirmed that a fix has been merged on 84eb9d a year ago
CollectiveAccess has been awarded the fix bounty
to join this conversation