Apache Roller Session Management Vulnerability Allowing Unauthorized Access After Password Change

A session management vulnerability exists in Apache Roller versions prior to 6.1.5. The issue arises because active user sessions are not properly invalidated after a password change. This means that when a password is changed, either by the user or an administrator, existing sessions remain active. As a result, access to the application can continue through these old sessions, potentially leading to unauthorized access if the previous credentials were compromised.

Impact

Exploitation of this vulnerability could result in unauthorized access to the application through active sessions, even after a password change.

Remediation

Users can upgrade to Apache Roller version 6.1.5, which includes a new session management implementation that properly invalidates all active sessions when passwords are changed or users are disabled. This version is available for download from the Apache Roller website.