PT-2025-52528 · Unknown · Ldap Tool Box Self Service Password

Tahar Bennacef · Published 2025-12-19 · Updated 2025-12-20 · CVE-2023-53958

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions LDAP Tool Box Self Service Password version 1.5.2

Description The software contains a password reset issue where attackers can manipulate HTTP Host headers during token generation. This allows crafting malicious password reset requests that generate tokens sent to a server controlled by the attacker. Successful exploitation could lead to account takeover by intercepting and using stolen reset tokens. The vulnerability involves manipulating the Host header during the token generation process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-53958

Affected Products

Ldap Tool Box Self Service Password

References · 8

• 🔥 https://exploit-db.com/exploits/51275 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53958 · Security Note
• https://github.com/ltb-project/self-service-password · Note
• https://t.me/CVEtracker/40320 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002138332424192080 · Twitter Post
• https://twitter.com/CVEnew/status/2002466763452166469 · Twitter Post
• https://vulncheck.com/advisories/ldap-tool-box-self-service-password-account-takeover-via-http-host-header · Note