“A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes,” reads the advisory. A critical security vulnerability in Apache Roller has been discovered, allowing attackers to maintain unauthorized access to blog systems even after password changes. The patched version implements proper centralized session management that ensures all active sessions are immediately terminated when passwords are changed or user accounts are disabled. The technical issue involves the absence of centralized session management that properly tracks and terminates active sessions upon credential changes. When credentials are suspected of being compromised, the immediate response is typically to change passwords – but with this flaw, attackers who have already established sessions can continue operating within the system unimpeded. Users of Apache Roller are strongly advised to update to version 6.1.5 as soon as possible to mitigate this security risk. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Administrators are urged to prioritize this update due to the critical nature of the vulnerability and the ease with which it could be exploited by attackers with initial access to the system.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 15 Apr 2025 08:30:11 +0000