CVE-2023-26770

Summary

TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: total

References

• https://github.com/JordanKnott/taskcafe
• https://bishopfox.com/blog/taskcafe-version-0-3-2-advisory

• ←Previous
• Next→