PT-2023-10250 · Unknown · Ezpublish-Modern-Legacy

Published 2023-01-19 · Updated 2024-05-17 · CVE-2015-10071

Positive Technologies (AI Summary)

CVSS v2.0

1.4

Low

Base vector

AV:A/AC:H/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ezpublish-modern-legacy versions prior to 1.0

Description A vulnerability was found in the processing of the file kernel/user/forgotpassword.php, leading to weak password recovery. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations For versions prior to 1.0, upgrade to version 1.0 to address this issue. As a temporary workaround, consider restricting access to the forgotpassword.php file until the upgrade is applied.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2015-10071

Affected Products

Ezpublish-Modern-Legacy

References · 7

• https://github.com/gitter-badger/ezpublish-modern-legacy/commit/5908d5ee65fec61ce0e321d586530461a210bf2a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-10071 · Security Note
• https://github.com/gitter-badger/ezpublish-modern-legacy/releases/tag/1.0 · Patch
• https://t.me/cvenotify/59788 · Telegram Post
• https://vuldb.com/?ctiid.218951 · Note
• https://t.me/cvenotify/42408 · Telegram Post
• https://vuldb.com/?id.218951 · Note