PT-2022-15834 · Habitica · Habitica

Sabrecat · Published 2022-06-22 · Updated 2022-06-29 · CVE-2022-23078

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Habitica versions v4.119.0 through v4.232.2

Description The issue concerns an open redirect via the login page.

Recommendations For versions v4.119.0 through v4.232.2, update to a version that is not within this range to resolve the issue. As a temporary workaround, consider restricting access to the login page until a patch is available.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-23078

Affected Products

Habitica

References · 7

• 🔥 https://mend.io/vulnerability-database/CVE-2022-23078 · Exploit
• https://github.com/HabitRPG/habitica/commit/5bcfdbe066e8c899f3ecf3fdcdbacc2ecba7f02f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23078 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23078 · Vendor Advisory
• https://t.me/cvenotify/32357 · Telegram Post
• https://t.me/cibsecurity/44936 · Telegram Post
• https://t.me/cvenotify/31992 · Telegram Post