PT-2022-11858 · Atutor · Atutor

Published 2022-04-08 · Updated 2022-04-15 · CVE-2021-43498

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ATutor version 2.2.4

Description An Access Control issue exists in the password reminder.php file when the g, id, h, form password hidden, and form change HTTP POST parameters are set. This allows for potential unauthorized access.

Recommendations For ATutor version 2.2.4, as a temporary workaround, consider restricting access to the password reminder.php file until a patch is available. Avoid using the parameters g, id, h, form password hidden, and form change in the affected HTTP POST request until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2021-43498

Affected Products

Atutor

References · 5

• 🔥 https://github.com/atutor/ATutor/blob/master/password_reminder.php · Exploit
• 🔥 https://packetstormsecurity.com/files/157563/ATutor-LMS-2.2.4-Weak-Password-Reset-Hash.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-43498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43498 · Security Note
• https://t.me/cibsecurity/40402 · Telegram Post