Ubuntu.comUB:CVE-2019-13240CVE-2019-13240
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
73.1%
An issue was discovered in GLPI before 9.4.1. After a successful password
reset by a user, it is possible to change that user’s password again during
the next 24 hours without any information except the associated email
address.
References
github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7
github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6
github.com/glpi-project/glpi/compare/1783b78...8e621f6
github.com/glpi-project/glpi/releases/tag/9.4.1
launchpad.net/bugs/cve/CVE-2019-13240
nvd.nist.gov/vuln/detail/CVE-2019-13240
security-tracker.debian.org/tracker/CVE-2019-13240
www.cve.org/CVERecord?id=CVE-2019-13240
www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
73.1%