PT-2023-20888 · Unknown · Peppermint

Thapanarath Khempetch · Publicado 2023-03-29 · Atualizado 2025-02-18 · CVE-2023-26984

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Peppermint version 0.2.4

Description The issue concerns the password reset function, allowing attackers to access emails and passwords of the Tickets page through a crafted request.

Recommendations For Peppermint version 0.2.4, consider disabling the password reset function temporarily until a patch is available to prevent exploitation.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-26984

Produtos afetados

Peppermint

Referências · 6

• 🔥 https://github.com/bypazs/CVE-2023-26984 · Exploit
• https://github.com/Peppermint-Lab/peppermint/tree/master · Nota
• https://osv.dev/vulnerability/CVE-2023-26984 · Aviso do Fabricante
• https://peppermint.sh · Nota
• https://t.me/cvenotify/111630 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26984 · Nota de Segurança