CVE-2021-37333

Name of the Vulnerable Software and Affected Versions Laravel Booking System Booking Core version 2.0

Description The issue concerns session management. When a password is changed at the "/user/profile/change-password" API endpoint, it does not invalidate a session opened in a different browser.

Recommendations For Laravel Booking System Booking Core version 2.0, as a temporary workaround, consider implementing a mechanism to invalidate all active sessions when a user changes their password. Restrict access to sensitive features until the session management issue is fully resolved.