PT-2023-32979 · Wallabag · Wallabag

Published 2023-10-02 · Updated 2023-10-02

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions wallabag versions prior to 2.6.7

Description The issue allows attackers to arbitrarily disable 2FA through "config/otp/app/disable" and "config/otp/email/disable" API endpoints.

Recommendations For versions prior to 2.6.7, upgrade your instance to version 2.6.7 or higher. As a temporary workaround, consider restricting access to the /config/otp/app/disable and /config/otp/email/disable API endpoints to minimize the risk of exploitation.

Fix

Related Identifiers

GHSA-56FM-HFP3-X3W3

Affected Products

Wallabag

References · 5

• https://osv.dev/vulnerability/GHSA-56fm-hfp3-x3w3 · Vendor Advisory
• https://github.com/wallabag/wallabag · Note
• https://github.com/wallabag/wallabag/commit/0cfdddc2eb0aee5ffb69bf499d377d75655ba157 · Note
• https://github.com/wallabag/wallabag/security/advisories/GHSA-56fm-hfp3-x3w3 · Note
• https://huntr.dev/bounties/4c446fe7-2a44-4907-b0cf-4ab77d75c487 · Note