PT-2011-5024 · One Click Orgs · One Click Orgs

Darren Mcdonald · Publicado 2011-12-06 · Atualizado 2011-12-08 · CVE-2011-4678

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions One Click Orgs versions prior to 1.2.3

Description The password reset feature generates different error messages for failed reset attempts depending on whether the e-mail address is registered. This allows remote attackers to enumerate user accounts via a series of requests.

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider modifying the password reset feature to return generic error messages for all failed reset attempts, regardless of whether the e-mail address is registered.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2011-4678

Produtos afetados

One Click Orgs

Referências · 3

• https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4678 · Nota de Segurança
• http://dmcdonald.net/?page_id=43 · Nota