exploitDog

CVE-2021-29023

Опубликовано: 17 мая 2021

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.

Ссылки

https://github.com/InvoicePlane/InvoicePlane/pull/767
Patch
Third Party Advisory
https://notnnor.github.io/research/2021/03/16/weak-password-recovery-mechanism-in-invoiceplane.html
Exploit
Issue Tracking
Third Party Advisory
https://github.com/InvoicePlane/InvoicePlane/pull/767
Patch
Third Party Advisory
https://notnnor.github.io/research/2021/03/16/weak-password-recovery-mechanism-in-invoiceplane.html
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:invoiceplane:invoiceplane:1.5.11:*:*:*:*:*:*:*

EPSS

Процентиль: 36%

0.00155

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-307

Связанные уязвимости

GHSA-q62q-p9mg-92r4

CVSS3: 5.3

github

больше 3 лет назад

InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.

EPSS

Процентиль: 36%

0.00155

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-307