Dovestones Software AD Self Password Reset fails to properly restrict password reset request to authorized users

Overview

Dovestones Software AD Self Password Reset, version 3.0.3.0 and earlier, fails to properly validate users, which enables an unauthenticated attacker to reset passwords for arbitrary accounts.

Description

CWE-284: Improper Access Control - CVE-2015-8267

Dovestones Software AD Self Password Reset contains a vulnerable method PasswordReset.Controllers.ResetController.ChangePasswordIndex() in PasswordReset.dll that fails to validate the requesting user. An attacker can reset passwords for arbitrary accounts by manipulating web application requests that call the vulnerable method.

---

Impact

A remote, unauthenticated attacker can reset passwords for arbitrary accounts where usernames are known or can be guessed.

---

Solution

Apply an update

The vendor has released version 3.0.4.0 and has worked directly with customers to address this and other vulnerabilities. Users are encouraged to update to the latest version.

---

Vendor Information

757840

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Dovestones Software Affected

Notified: October 19, 2015 Updated: December 18, 2015

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• <http://www.dovestones.com/security-vulnerability-in-ad-self-password-reset-v3-0-3-0/&gt;

CVSS Metrics

Group	Score	Vector
Base	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal	5.9	E:POC/RL:OF/RC:C
Environmental	1.5	CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

• <http://www.dovestones.com/security-vulnerability-in-ad-self-password-reset-v3-0-3-0/&gt;
• <http://www.dovestones.com/active-directory-password-reset/&gt;
• <https://cwe.mitre.org/data/definitions/284.html&gt;

Acknowledgements

Thanks to Adam Caudill for reporting this vulnerability.

This document was written by Joel Land.

Other Information

CVE IDs:	CVE-2015-8267
Date Public:	2015-12-18 Date First Published: