CVE-2017-17097
Summary
| CVE | CVE-2017-17097 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-01-02 15:29:00 UTC |
| Updated | 2018-01-18 23:25:00 UTC |
| Description | gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php. |
Risk And Classification
Problem Types: CWE-640
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Gps-server | Gps Tracking Software | 2.1.1 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.3 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.4 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.6 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.8 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.9 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.1 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.3 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.3.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.3.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.4 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.4.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.8 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.9 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.6 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.8 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.8.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.1 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.6 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.1 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.3 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.4 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.6 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.8 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.1.9 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.1 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.2.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.3 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.3.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.3.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.4 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.4.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.8 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.5.9 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.6 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.7 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.8 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.8.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.1 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.2 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.5 | All | All | All |
| Application | Gps-server | Gps Tracking Software | 2.9.6 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| s1.gps-server.net/changelog.txt | MISC | s1.gps-server.net | Release Notes, Vendor Advisory |
| gps-server.net SAAS CMS multiple vulnerabilities.txt · GitHub | MISC | gist.github.com | Patch, Third Party Advisory |
| gps-server.net GPS Tracking Software < 3.1 - Multiple Vulnerabilities - PHP webapps Exploit | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.