PT-2021-16904 · Talkyard · Talkyard

Published 2021-11-11 · Updated 2021-11-16 · CVE-2021-25980

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Talkyard versions v0.04.01 through v0.6.74-WIP-63220cb Talkyard versions v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 Talkyard versions tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular

Description The issue allows an unauthenticated attacker to use the "forgot password" functionality to reset a victim's password and take over their account by luring the victim to click on a link. This is possible due to Host Header Injection.

Recommendations For Talkyard versions v0.04.01 through v0.6.74-WIP-63220cb, consider disabling the "forgot password" functionality until a patch is available. For Talkyard versions v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1, restrict access to the password reset feature to minimize the risk of exploitation. For Talkyard versions tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, avoid using the "forgot password" feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-25980

Affected Products

Talkyard

References · 6

• https://github.com/debiki/talkyard/commit/4067e191a909ed06f250d09a40e43aa5edbb0289 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25980 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25980 · Vendor Advisory
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25980 · Note
• https://t.me/cibsecurity/32235 · Telegram Post
• https://t.me/cvenotify/23261 · Telegram Post