PT-2023-23274 · Unknown · Serenity Serene+1

Fabian Densborn · Published 2023-04-27 · Updated 2025-01-31 · CVE-2023-31287

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serenity Serene versions prior to 6.7.0 StartSharp versions prior to 6.7.0

Description An issue was discovered where password reset links sent by email contain a token that remains valid even after the password reset, allowing it to be used again to change the password of the corresponding user. This token expires 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can use the token again to change the password and take over the account.

Recommendations For versions prior to 6.7.0, update to version 6.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to password reset links and tokens to minimize the risk of exploitation. Avoid using the password reset feature until the issue is resolved, and ensure that browser history is cleared regularly to prevent token reuse.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-31287

GHSA-2HP9-3XFR-R9W2

Affected Products

Serenity Serene

Startsharp

References · 9

• 🔥 https://packetstorm.news/files/id/172648 · Exploit
• https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2hp9-3xfr-r9w2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31287 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31287 · Vendor Advisory
• https://github.com/serenity-is/Serenity · Note
• https://t.me/cvenotify/109519 · Telegram Post
• http://seclists.org/fulldisclosure/2023/May/14 · Note
• http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html · Note