# User's session persist after permanently deleting his account in [glpi-project/glpi](https://github.com/glpi-project/glpi)

Valid

Reported on Sep 18th 2022

---

# Description

If a user is logged in, and an admin decided to **delete** his account **permanently**, the user is still able to perform his normal actions until his session gets expired.

If a logged in user with **admin role** is deleted permanently, he's still able to **delete** other admins **permanently**, and if they are not logged in at that moment, they won't be able to access their account in the future.

# Proof of Concept

- Login as "admin" (Super-Admin)
- Create a user ( tmp\_admin ) with admin role
- Login as "tmp\_admin" in another browser
- Using the "admin" account, delete "tmp\_admin" account permanently
- Go back the other browser where "tmp\_admin" is logged in, and perform your normal actions, like creating a ticket, etc.
- Log out from "admin" account
- Using "tmp\_admin" delete the "admin" account permanently
- Now, you can't login as "admin"

# Impact

- A permanently deleted low privileged user can perform spamming since he's able to create tickets, also he can access the tickets that he's been assigned to and see the new answers.

- A permanently deleted high privileged user can manage to permanently delete other admins and prevents them from accessing their accounts again, which may lead to total loss of all accounts.

# CVE

[CVE-2022-39234](https://nvd.nist.gov/vuln/detail/CVE-2022-39234) published

## Vulnerability Type

[CWE-613: Insufficient Session Expiration](https://cwe.mitre.org/data/definitions/613.html)

## Severity

Medium (4.7)

### Attack vector
Local

### Attack complexity
High

### Privileges required
High

### User interaction
None

### Scope
Unchanged

### Confidentiality
High

### Integrity
Low

### Availability
None

[Open in visual CVSS calculator](https://cvss.js.org/#CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N)

## Registry

Other

## Affected Version

10.0.3

## Visibility

Public

## Status

Fixed

## Found by

[Seif-Allah Homrani](/content/users/seifallahhomrani1/index.html) @seifallahhomrani1  
LIGHTWEIGHT