PT-2021-23964
CVE-2021-43833
·
تاريخ النشر
2021-12-15
·
تاريخ التحديث
2021-12-21
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
eLabFTW versions prior to 4.2.0
Description:
The issue allows any authenticated user to gain access to arbitrary accounts by setting a specially crafted email address, impacting instances without an explicit email domain name allowlist. Administrators and targeted users are not notified of account changes. An attacker needs to control an account to exploit this. The default settings require administrators to validate newly created accounts.
Recommendations:
For versions prior to 4.2.0, upgrade to at least version 4.2.0 to resolve the issue.
For users unable to upgrade, enable an email domain allow list from the Sysconfig panel, Security tab, to completely resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾