PT-2023-18286 · Modoboa · Modoboa

Ahmed Hassan + 1 · Published 2023-04-18 · Updated 2023-12-18 · CVE-2023-2160

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions modoboa/modoboa versions prior to 2.1.0

Description The issue is related to weak password requirements in the modoboa/modoboa GitHub repository. Users can set unsafe passwords, such as 1 or HACK. This issue is fixed in version 2.1.0.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 to resolve the issue. As a temporary workaround, consider enforcing strong password policies to minimize the risk of exploitation. Restrict access to password settings to prevent users from setting weak passwords until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2023-2160

GHSA-9GXX-32P7-FF7M

PYSEC-2023-34

Affected Products

Modoboa

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2160.json · Exploit
• 🔥 https://huntr.dev/bounties/54fb6d6a-6b39-45b6-b62a-930260ba484b · Exploit
• https://github.com/modoboa/modoboa/commit/130257c96a2392ada795785a91178e656e27015c · Patch
• https://osv.dev/vulnerability/PYSEC-2023-34 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2160 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2160 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gxx-32p7-ff7m · Vendor Advisory
• https://github.com/modoboa/modoboa · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/modoboa/PYSEC-2023-34.yaml · Note
• https://t.me/cvenotify/49225 · Telegram Post
• https://t.me/cibsecurity/62362 · Telegram Post