Automattic · Report #13939
information disclosure
Validstatus
1upvotes
16 Jul 2014disclosed
How it was found
Use Google chrome 35.0.1916.114m for reproduction
- go to https://app.simplenote.com/
- login into the app.
- Now press logout, and press back button on browser. You will see the session back.This is the information disclosure vulnerability.
I recommend checking for a valid, authenticated session and if there isn't one redirect to the login page.