PT-2021-18027 · Unknown · Invoiceplane

Naui95 · Published 2021-05-17 · Updated 2023-03-01 · CVE-2021-29023

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: InvoicePlane version 1.5.11

Description: The issue concerns a lack of rate-limiting for password reset and the use of a weak mechanism to generate reset tokens, making them predictable.

Recommendations: For InvoicePlane version 1.5.11, consider disabling the password reset feature until a patch is available to prevent potential exploitation. Restrict access to the password reset module to minimize the risk of exploitation. Avoid using the password reset functionality in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2021-29023

Affected Products

Invoiceplane

References · 5

• 🔥 https://notnnor.github.io/research/2021/03/16/weak-password-recovery-mechanism-in-invoiceplane.html · Exploit
• https://github.com/InvoicePlane/InvoicePlane/pull/767 · Patch
• https://osv.dev/vulnerability/CVE-2021-29023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29023 · Security Note
• https://t.me/cvenotify/14541 · Telegram Post