PT-2023-25449 · Phpjabbers · Phpjabbers Cleaning Business

Publicado 2023-08-03 · Atualizado 2023-08-05 · CVE-2023-36139

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPJabbers Cleaning Business Software version 1.0

Description The issue allows remote attackers to take over accounts due to a lack of verification when changing an email address and/or password on the Profile Page.

Recommendations For PHPJabbers Cleaning Business Software version 1.0, consider temporarily restricting access to the Profile Page until a proper verification mechanism for email address and password changes is implemented. As a mitigation measure, restrict the ability to change email addresses and passwords to minimize the risk of account takeover. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2023-36139

Produtos afetados

Phpjabbers Cleaning Business

Referências · 5

• https://phpjabbers.com/cleaning-business-software · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-36139 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-36139 · Aviso do Fabricante
• https://t.me/cvenotify/55836 · Publicação no Telegram
• https://medium.com/%40bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4 · Nota