PT-2024-37448 · Haloitsm · Haloitsm

Published 2024-08-06 · Updated 2024-08-29 · CVE-2024-6203

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions: HaloITSM versions up to 2.146.1

Description: The issue allows malicious actors to send poisoned password reset links to existing users, given their email address is known. When these links are accessed, the password reset token is leaked, enabling the malicious actor to set a new password for the victim's account. This can lead to account takeover attacks.

Recommendations: For HaloITSM versions up to 2.146.1, update to a version past 2.146.1 or apply patches starting from 2.143.61 to fix the vulnerability.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2024-6203

Affected Products

Haloitsm

References · 5

• https://haloitsm.com/guides/article/?kbid=2155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6203 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6203 · Vendor Advisory
• https://t.me/cvedetector/2539 · Telegram Post
• https://twitter.com/cydcampus/status/1825465379964997884 · Twitter Post