PivotX Password Reset Security Bypass Vulnerability
BID:46463
Info
PivotX Password Reset Security Bypass Vulnerability
| Bugtraq ID: | 46463 |
| Class: | Access Validation Error |
| CVE: |
CVE-2011-1035 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 18 2011 12:00AM |
| Updated: | Feb 18 2011 12:00AM |
| Credit: | Hans F. Nordhaug |
| Vulnerable: |
PIVOTX PivotX 2.2.3 PIVOTX PivotX 2.2.2 PIVOTX PivotX 2.2 |
| Not Vulnerable: |
PIVOTX PivotX 2.2.5 |
Discussion
PivotX Password Reset Security Bypass Vulnerability
PivotX is prone to a security-bypass vulnerability because they fail to adequately restrict access to the password-reset feature.
An attacker can exploit this issue to gain administrative access and compromise the application; other attacks are also possible.
PivotX 2.2.3 and prior are vulnerable.
PivotX is prone to a security-bypass vulnerability because they fail to adequately restrict access to the password-reset feature.
An attacker can exploit this issue to gain administrative access and compromise the application; other attacks are also possible.
PivotX 2.2.3 and prior are vulnerable.
Exploit / POC
PivotX Password Reset Security Bypass Vulnerability
Attackers can exploit this issue via a browser.
Attackers can exploit this issue via a browser.
Solution / Fix
PivotX Password Reset Security Bypass Vulnerability
Solution:
The vendor has released updates. Please see the references for details.
Solution:
The vendor has released updates. Please see the references for details.
References
PivotX Password Reset Security Bypass Vulnerability
References:
References:
- PivotX 2.2.5 released (PIVOTX)
- PivotX Homepage (PIVOTX)