PT-2023-18286 · Modoboa · Modoboa

Ahmed Hassan + 1 · Publicado 2023-04-18 · Atualizado 2023-12-18 · CVE-2023-2160

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions modoboa/modoboa versions prior to 2.1.0

Description The issue is related to weak password requirements in the modoboa/modoboa GitHub repository. Users can set unsafe passwords, such as 1 or HACK. This issue is fixed in version 2.1.0.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 to resolve the issue. As a temporary workaround, consider enforcing strong password policies to minimize the risk of exploitation. Restrict access to password settings to prevent users from setting weak passwords until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-521

Identificadores relacionados

CVE-2023-2160

GHSA-9GXX-32P7-FF7M

PYSEC-2023-34

Produtos afetados

Modoboa

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2160.json · Exploit
• 🔥 https://huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b · Exploit
• https://github.com/modoboa/modoboa · Nota
• https://github.com/modoboa/modoboa/commit/130257c96a2392ada795785a91178e656e27015c · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/modoboa/PYSEC-2023-34.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2023-34 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2160 · Nota de Segurança
• https://t.me/cvenotify/49225 · Publicação no Telegram
• https://t.me/cibsecurity/62362 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2160 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9gxx-32p7-ff7m · Aviso do Fabricante