PT-2011-5024 · One Click Orgs · One Click Orgs

Darren Mcdonald · Published 2011-12-06 · Updated 2011-12-08 · CVE-2011-4678

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions One Click Orgs versions prior to 1.2.3

Description The password reset feature generates different error messages for failed reset attempts depending on whether the e-mail address is registered. This allows remote attackers to enumerate user accounts via a series of requests.

Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue. As a temporary workaround, consider modifying the password reset feature to return generic error messages for all failed reset attempts, regardless of whether the e-mail address is registered.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2011-4678

Affected Products

One Click Orgs

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-4678 · Security Note
• https://groups.google.com/group/oneclickorgs-devspace/msg/26c40a4cc9e127d2?hl=en&dmode=source&output=gplain · Note
• http://dmcdonald.net/?page_id=43 · Note