HCL Aftermarket DPC Failure to Invalidate Session on Password Change Vulnerability Allowing Account Takeover

A vulnerability exists in HCL Aftermarket DPC due to a failure to properly invalidate sessions when a password is changed. This oversight allows an attacker to retain access to a user's session, enabling them to maintain control over the account even after the password has been updated, potentially leading to unauthorized actions on behalf of the user.

Impact

Exploitation of this vulnerability can result in unauthorized account access and control, allowing an attacker to perform actions on behalf of the user.