eZ Publish 'kernel/user/forgotpassword.php' Predictable Token Security Bypass Vulnerability
BID:74749
Info
eZ Publish 'kernel/user/forgotpassword.php' Predictable Token Security Bypass Vulnerability
| Bugtraq ID: | 74749 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 20 2015 12:00AM |
| Updated: | May 20 2015 12:00AM |
| Credit: | Vincent Herbulot (@us3r777) |
| Vulnerable: |
Ez Ez Publish 5.3.4 Ez Ez Publish 4.7 Ez Ez Publish 5.4.1.1 Ez Ez Publish 5.2 Ez Ez Publish 5.1 Ez Ez Publish 5.0 Ez Ez Publish 4.6 Ez Ez Publish 4.5 Ez Ez Publish 2015.01 |
| Not Vulnerable: |
Ez Ez Publish 5.4.2 Ez Ez Publish 5.3.5 Ez Ez Publish 2015.03 |
Discussion
eZ Publish 'kernel/user/forgotpassword.php' Predictable Token Security Bypass Vulnerability
eZ Publish is prone to a security-bypass vulnerability.
An attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; this may lead to further attacks.
eZ Publish versions 4.5.0, 4.6.0, 4.7.0, 5.0, 5.1, 5.2, 2015.01, 5.3.4, and 5.4.1.1 are vulnerable.
eZ Publish is prone to a security-bypass vulnerability.
An attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; this may lead to further attacks.
eZ Publish versions 4.5.0, 4.6.0, 4.7.0, 5.0, 5.1, 5.2, 2015.01, 5.3.4, and 5.4.1.1 are vulnerable.
Exploit / POC
eZ Publish 'kernel/user/forgotpassword.php' Predictable Token Security Bypass Vulnerability
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.