Comment 2 for bug 1363873

Hi Aaron,

Glad to receive response from your end.

I would be lucky to be listed on Mahara Contributor Page. Below are the
details

Abhishek Dashora (https://www.facebook.com/ad271)

Thanks and Regards,
Abhishek Dashora

On Fri, Oct 31, 2014 at 11:02 AM, Aaron Wells <email address hidden>
wrote:

> Hi Abhishek,
>
> Sorry, for the slow reply. This bug report must have slipped through the
> cracks.
>
> We'll take a look at this. Do you want to be listed on the Mahara
> Project's security contributors page?
> https://wiki.mahara.org/index.php/Contributors#Security_researchers
>
> If so, please let me know if you want your Twitter handle or other URL
> next to your name.
>
> Cheers,
> Aaron
>
> ** Changed in: mahara
> Status: New => Confirmed
>
> ** Changed in: mahara
> Importance: Undecided => High
>
> ** Changed in: mahara
> Milestone: None => 15.04.0
>
> ** Also affects: mahara/15.04
> Importance: High
> Status: Confirmed
>
> ** Also affects: mahara/1.9
> Importance: Undecided
> Status: New
>
> ** Also affects: mahara/1.10
> Importance: Undecided
> Status: New
>
> ** Also affects: mahara/1.8
> Importance: Undecided
> Status: New
>
> ** Changed in: mahara/1.10
> Milestone: None => 1.10.1
>
> ** Changed in: mahara/1.8
> Milestone: None => 1.8.6
>
> ** Changed in: mahara/1.9
> Milestone: None => 1.9.4
>
> ** Changed in: mahara/1.10
> Importance: Undecided => High
>
> ** Changed in: mahara/1.8
> Importance: Undecided => High
>
> ** Changed in: mahara/1.9
> Importance: Undecided => High
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1363873
>
> Title:
> Session Management Issue- Session is not invalidating after password
> change
>
> Status in Mahara ePortfolio:
> Confirmed
> Status in Mahara 1.10 series:
> New
> Status in Mahara 1.8 series:
> New
> Status in Mahara 1.9 series:
> New
> Status in Mahara 15.04 series:
> Confirmed
>
> Bug description:
> Hi Security Team,
>
> I have discovered the session management issue on the domain
> https://mahara.org/
>
> Description of the issue-
>
> The application does not invalidate the previous session once the
> password is changed by the legitimate user.
>
> How to reproduce?-
>
> 1. Login in the application using https://mahara.org/ and login into
> the application.
> 2. Lets assume application user's account is compromised so he wants to
> change his password, he will navigate to forgot password page and will
> change his password.
> 3. Application user is able to change his password but it was observed
> that still the previous session was not invalidated and i was actually able
> to browse the application from both the sessions.
>
> Impact- If the application user's account is compromised, he will simply
> change his password but if the previous session is not invalidated there is
> no use of changing the password.
> Please let me know if you need video PoC for this.
>
> Remediation- Invalidate the previous session once the password has
> been changed and enforce the application user to relogin in the
> application.
>
> Thanks and Regards,
> Abhishek Dashora
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/mahara/+bug/1363873/+subscriptions
>