Ushahidi Forgotten Reset Password Security Bypass Vulnerability

Bugtraq ID:	56748
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 30 2012 12:00AM
Updated:	Nov 30 2012 12:00AM
Credit:	Timothy D. Morgan
Vulnerable:	Ushahidi Ushahidi 2.2
Not Vulnerable:

Ushahidi Forgotten Reset Password Security Bypass Vulnerability

Ushahidi is prone to a security-bypass vulnerability.

An attacker may exploit this issue to reset account passwords for arbitrary users which may aid in further attacks.

Versions prior to Ushahidi 2.6.1 are vulnerable.

Ushahidi Forgotten Reset Password Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Ushahidi Forgotten Reset Password Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.

Ushahidi Forgotten Reset Password Security Bypass Vulnerability

References:

• Fixed Make forgot password tokens use better random token #646 (Ushahidi)
  
• Make forgot password tokens use better random number gen (Ushahidi )
  
• Ushahidi Homepage (Ushahidi )
  
• Vulnerability: Forgotten password challenge guessable (Ushahidi)