Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #12219 Reset passord links are not invalidated on password change
    Actions
    Infos
    #12219
    Thomas Gerbet (tgerbet)
    2018-09-21 21:07
    2018-09-03 09:47
    12890
    Details
    Reset passord links are not invalidated on password change

    Reset password links are not invalidated after a user changes its password.

    Impact

    This issue could allow an attacker to persist access to a compromised user account.
    CVSSv3 score: 3.8 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)

    Exploitation

    1. A user got its account compromised, the attacker change the mail address and ask for a reset link
    2. The user recovers the account and changes the password. The user now thinks its account is safe.
    3. The attacker can use the reset link previously generated to change the password again and compromise the account again.

    Credits

    Thank you to Swapnil Jain for finding and reporting this issue.

    References

    CVE-2018-17298

    CWE 640

    Authentication & LDAP
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Empty
    Closed
    2018-09-04
    Attachments
    Artifact links

    Releases

    Fixed in

    Artifact ID Project Tracker Summary Status Last Update Date Submitted By Assigned to
    rel #11901 Tuleap Releases 10.5 Delivered 2018-09-14 15:21 Manuel Vacelet (vaceletm)
    Empty
    References
    Referencing request #12219

    Git commit

    tuleap/tuleap/stable

    Merge commit 'refs/changes/37/12537/2' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD b87d3b807f
    User avatar Nicolas Terray (nterray) , 2018-09-04 11:58
    request #12219: Reset passord links are not invalidated on password change 4050b0aafd
    User avatar Thomas Gerbet (tgerbet) , 2018-09-03 14:37
    Referenced by request #12219

    Artifact Tracker v5

    rel #11901 10.5

    Other

    gerrit #12537
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2018-09-21 21:07
    Adding CVE ID.
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2018-09-03 11:38
    A patch is under review: gerrit #12537.
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    • Status changed from Under implementation to Under review