KLA10726 Security bypass vulnerability in Dovetones AD Self Password Reset

An unspecified vulnerability was found in Dovestones AD Self Password Reset. By exploiting this vulnerability malicious users can reset arbitrary passwords. This vulnerability can be exploited remotely via a specially designed request.

Technical details

This vulnerability related to PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll and can be triggered by attacker with valid username only.

Original advisories

Dovestones advisory

Related products

Dovestones-AD-Self-Password-Reset

CVE list

CVE-2015-8267 critical

Solution

Update to the latest version

Dovestones products download page

Impacts

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Dovestones AD Self Password Reset versions earlier than 3.0.4.0