PT-2020-16685

CVE-2020-27408

Published

2020-12-04

Updated

2021-07-21

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSIS Community Edition versions through 7.6

Description The issue is related to incorrect access controls for the file ResetUserInfo.php, allowing an unauthenticated attacker to change the password of arbitrary users.

Recommendations For OpenSIS Community Edition versions through 7.6, consider restricting access to the ResetUserInfo.php file until a proper fix is applied. As a temporary workaround, restrict access to the vulnerable file to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Oliver Matula

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Related identifiers