Session Management Flaw in Progress Sitefinity Affects User Security

CVE-2019-7215

Summary

Progress Sitefinity version 10.1.6536 contains a flaw in session management that fails to invalidate session cookies upon user logout. Instead of properly terminating the session, the application attempts to overwrite the session cookie in the browser, allowing the cookie to remain valid on the server side. This oversight can be exploited by malicious parties, enabling them to maintain access to user accounts despite changes to credentials or permissions. Proper session invalidation is essential to prevent unauthorized access and protect user data.

References