PT-2017-12172 · Unknown · Hashtopussy

Publicado 2017-07-27 · Atualizado 2017-08-02 · CVE-2017-11680

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hashtopussy version 0.4.0

Description A Cross-Site Request Forgery (CSRF) issue exists, allowing an unauthorized change of the admin password through the users.php endpoint.

Recommendations For Hashtopussy version 0.4.0, consider disabling access to the users.php endpoint until a patch is available to prevent potential admin password changes.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-11680

Produtos afetados

Hashtopussy

Referências · 3

• 🔥 https://github.com/s3inlc/hashtopussy/issues/241 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11680 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11680 · Aviso do Fabricante