PT-2025-47340 · Unknown · Openml.Org Web Application

Publicado 2025-11-18 · Atualizado 2025-11-19 · CVE-2025-55796

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions openml/openml.org web application version v2.0.20241110

Description The web application generates predictable tokens based on MD5 hashing for critical user actions, including signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are created by hashing the current timestamp formatted as "%d %H:%M:%S" without user-specific data or cryptographic randomness. This predictability allows attackers to brute-force valid tokens within a short timeframe, potentially enabling unauthorized account confirmation, password resets, and email change approvals, which could lead to account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2025-55796

GHSA-XFJH-GF9P-8QR6

Produtos afetados

Openml.Org Web Application

Referências · 8

• 🔥 https://github.com/openml/openml.org/security/advisories/GHSA-xfjh-gf9p-8qr6 · Exploit
• https://github.com/openml/openml.org · Nota
• https://t.me/CVEtracker/37640 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1990882168654954920 · Publicação no Twitter
• https://github.com/openml · Nota
• https://twitter.com/CVEnew/status/1991042995928375680 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-55796 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-55796 · Nota de Segurança