PT-2024-31868 · Scheduler · Scheduler

Sourajeet Majumder · Published 2024-09-26 · Updated 2024-10-01 · CVE-2024-45982

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions scheduleR version 0.0.18

Description A host header injection vulnerability allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This enables attackers to arbitrarily reset other users' passwords and compromise their accounts.

Recommendations For scheduleR version 0.0.18, consider disabling the password reset functionality until a patch is available to prevent exploitation of the host header injection vulnerability. Restrict access to the password reset link to minimize the risk of account compromise.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-45982

Affected Products

Scheduler

References · 7

• 🔥 https://github.com/soursec/CVEs/tree/main/CVE-2024-45982 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45982 · Security Note
• https://twitter.com/CVEnew/status/1839348149258776886 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1839392934430413229 · Twitter Post
• https://t.me/cvenotify/96189 · Telegram Post
• https://t.me/cvedetector/6429 · Telegram Post
• https://twitter.com/cracbot/status/1840995140904886293 · Twitter Post