PT-2017-12172 · Unknown · Hashtopussy

Published 2017-07-27 · Updated 2017-08-02 · CVE-2017-11680

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hashtopussy version 0.4.0

Description A Cross-Site Request Forgery (CSRF) issue exists, allowing an unauthorized change of the admin password through the users.php endpoint.

Recommendations For Hashtopussy version 0.4.0, consider disabling access to the users.php endpoint until a patch is available to prevent potential admin password changes.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-11680

Affected Products

Hashtopussy

References · 3

• 🔥 https://github.com/s3inlc/hashtopussy/issues/241 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11680 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11680 · Vendor Advisory