Migrating to FTH4

Your club admin received the instructions to update their admin password to access FTH4. (FTH3 admin passwords will NOT work in FTH4). Follow the instructions in the email and use 'Member sign in' in the top right corner to access the Club Admin account.

If you are not sure who the club admin is, in your member account; look at 'Club Officers and Members' > "Club Email addresses". The LAST item in this list is the person who is currently listed as your club admin.

If this is not correct, please complete and submit this form to change your club admin:
www.toastmastersclubs.org/welcome/change-admin/

Security related - login as another user

  • JRamp
  • JRamp's Avatar Topic Author
  • Offline
  • New Member
  • New Member
  • Posts: 1
  • Thanks: 0

Security related - login as another user

11 years 5 months ago
#49312
Hello,
I've tested this in Chrome and replicated the behavior after seeing this happen initially. For security reasons I don't want to share publicly the entire vulnerability and steps to confirm - but would gladly discuss privately with support members.

The general idea is that after performing a couple steps as target user A , User B logs in and the website shows Users A name and Credentials as the person who has logged in. As User A , I can sign up for roles and edit A's profile, send out Agendas.

Let me know how to proceed.
Club#: 01766106
Club Address: 1766106.toastmastersclubs.org/
The topic has been locked.
  • RogerM
  • RogerM's Avatar
  • FreeToastHost Ambassador
  • FreeToastHost Ambassador
  • Thanks: 0

Re: Security related - login as another user

11 years 5 months ago
#49442
Fellow Ambassadors,

I've got this one. I have contacted the member via Private Message.
The topic has been locked.
  • RogerM
  • RogerM's Avatar
  • FreeToastHost Ambassador
  • FreeToastHost Ambassador
  • Thanks: 0

Re: Security related - login as another user

11 years 5 months ago
#49460
I think we found the problem.
The topic has been locked.
Moderators: Brian, Heni, Pam, RichardT, NotLiable, NSB, jgavin, Lcala305, peterb323, DebbieT
Time to create page: 0.164 seconds