PT-2017-18560 · Genix · Genixcms

Publicado 2017-05-08 · Atualizado 2022-05-17 · CVE-2017-8827

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeniXCMS version 1.0.2

Description The issue is related to the forgotpassword.php file, which lacks a rate limit. This might allow remote attackers to cause a denial of service, resulting in login inability, or possibly conduct Arbitrary User Password Reset attacks via a series of requests to the affected endpoint.

Recommendations For GeniXCMS version 1.0.2, consider implementing a rate limit on the forgotpassword.php file to prevent abuse and mitigate the risk of denial of service or Arbitrary User Password Reset attacks. As a temporary workaround, restrict access to the forgotpassword.php file until a proper rate limiting mechanism is in place.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-8827

GHSA-WM7G-RMGG-9837

Produtos afetados

Genixcms

Referências · 6

• https://github.com/semplon/GeniXCMS/commit/f7b4a8278cdcf29ecf7f1eaa1b9f088d505ca61a · Nota
• https://github.com/semplon/GeniXCMS/issues/75 · Correção
• https://github.com/GeniXCMS/GeniXCMS · Nota
• https://osv.dev/vulnerability/CVE-2017-8827 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-wm7g-rmgg-9837 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8827 · Nota de Segurança