PT-2023-20284 · Unknown · Tripleplay Platform
CVE-2023-25760
·
Publicado
2023-04-19
·
Atualizado
2025-02-05
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Tripleplay Platform versions prior to 3.4.0
Description
The issue allows an authenticated user to modify other users' passwords via a crafted request payload. This is due to incorrect access control in the platform.
Recommendations
For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to password modification features until the update is applied.
Correção
Insufficiently Protected Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Tripleplay Platform