DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 291F13858C66
MIME-Version: 1.0
References: <CAJVfQ_gj3N5+j+NpJytcYqMnMVMj-_p=EuLKsZ7BwnYWNRMgJg@mail.gmail.com>
In-Reply-To: <CAJVfQ_gj3N5+j+NpJytcYqMnMVMj-_p=EuLKsZ7BwnYWNRMgJg@mail.gmail.com>
Date: Thu, 7 Sep 2023 03:20:33 +0500
Message-ID: <CAJVfQ_h8Roac9HoqbJNEe_C-iRPu1GjBaSvV2v+v_CQor0H5cA@mail.gmail.com>
Subject: Re: bug report
To: cygwin@cygwin.com
From: Asad Ali via Cygwin <cygwin@cygwin.com>
Reply-To: Asad Ali <asadali.282821@gmail.com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

Hi Team,

Is there any update on this ? I'm hoping to receive a reward for the
reported bug.

Waiting for your response.

On Fri, Dec 30, 2022 at 5:46 AM Asad Ali <asadali.282821@gmail.com> wrote:

> Hey Team,
>
>
>
> I'm a penetration tester and bug bounty hunter. I have found a potential
> vulnerability in the site. Please review the report below.
>
>
>
> Vulnerability: Broken Authentication & Session Management
> We have observed that when we change "password" from one browser in place
> of session expiration from another browser it just updates the password
> from another browser and the old session gets updated without being logged
> out. The flows goes like this:
> Broken Authentication and Session Management > Failure to Invalidate
> Session > On Password Change
> Steps:
>
> 1- Login from two browsers at a time [From Chrome browser and from Mozilla
> Firefox].
>
> 2- Change password in settings from chrome browser.
>
> 3- Now Check Mozilla Firefox.
>
> 4- Your Session got "updated" in place of expiration.
>
>
>
>
> Same goes with when using two different computer systems.
>
> 1- Login from two computers at a time
>
> 2- Change password in settings from computer A.
>
> 3- Now Check computer B.
> 4- Your Session got "updated" in place of expiration.
>
> Recommendations: If Session is Updating from one Browser/Computer so other
> should expire first to renew session after login.
>
>
>
> If you require any additional information, please let me know. I'll be
> waiting to hear from your side regarding the report and bounty.
>

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple