Описание
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
Ссылки
- ExploitVendor Advisory
- Third Party Advisory
- ExploitVendor Advisory
Уязвимые конфигурации
EPSS
8.8 High
CVSS3
Дефекты
Связанные уязвимости
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
Уязвимость метода userTracking() класса UserSession файла src/phpMyFAQ/User/UserSession.php веб-приложения phpMyFAQ, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
8.8 High
CVSS3