PT-2023-20888 · Unknown · Peppermint

Thapanarath Khempetch · Published 2023-03-29 · Updated 2025-02-18 · CVE-2023-26984

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Peppermint version 0.2.4

Description The issue concerns the password reset function, allowing attackers to access emails and passwords of the Tickets page through a crafted request.

Recommendations For Peppermint version 0.2.4, consider disabling the password reset function temporarily until a patch is available to prevent exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-26984

Affected Products

Peppermint

References · 6

• 🔥 https://github.com/bypazs/CVE-2023-26984 · Exploit
• https://osv.dev/vulnerability/CVE-2023-26984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26984 · Security Note
• https://github.com/Peppermint-Lab/peppermint/tree/master · Note
• https://peppermint.sh · Note
• https://t.me/cvenotify/111630 · Telegram Post