CVE-2024-6203

HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://haloitsm.com/guides/article/?kbid=2155	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:haloservicesolutions:haloitsm::::::::
	cpe:2.3:a:haloservicesolutions:haloitsm::::::::

History

No history.

Information

Published : 2024-08-06 06:15

Updated : 2024-08-29 17:46

NVD link : CVE-2024-6203

Mitre link : CVE-2024-6203

CVE.ORG link : CVE-2024-6203

JSON object : View

Products Affected

haloservicesolutions

haloitsm

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2024-6203", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2024-08-06T06:15:35.727", "references": [{"url": "https://haloitsm.com/guides/article/?kbid=2155", "tags": ["Vendor Advisory"], "source": "vulnerability@ncsc.ch"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-640"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability."}, {"lang": "es", "value": "Las versiones de HaloITSM hasta 2.146.1 se ven afectadas por una vulnerabilidad de envenenamiento por restablecimiento de contrase\u00f1a. Se pueden enviar enlaces de restablecimiento de contrase\u00f1a envenenados a usuarios existentes de HaloITSM (siempre que se conozca su direcci\u00f3n de correo electr\u00f3nico). Cuando se accede a estos enlaces envenenados (por ejemplo, manualmente por parte de la v\u00edctima o autom\u00e1ticamente mediante un software de cliente de correo electr\u00f3nico), el token de restablecimiento de contrase\u00f1a se filtra al actor malintencionado, lo que le permite establecer una nueva contrase\u00f1a para la cuenta de la v\u00edctima. Esto potencialmente conduce a la apropiaci\u00f3n de la cuenta. Las versiones de attack.HaloITSM posteriores a la 2.146.1 (y los parches a partir de la 2.143.61) corrigen la vulnerabilidad mencionada."}], "lastModified": "2024-08-29T17:46:28.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haloservicesolutions:haloitsm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C394C94-9968-465E-98B9-7BC8429BAD67", "versionEndExcluding": "2.143.61"}, {"criteria": "cpe:2.3:a:haloservicesolutions:haloitsm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEBD3BDE-57DA-41C9-821A-F8C6A8864FC7", "versionEndExcluding": "2.146.1", "versionStartIncluding": "2.144"}], "operator": "OR"}]}], "sourceIdentifier": "vulnerability@ncsc.ch"}