// For flags

CVE-2024-6203

HaloITSM - Password Reset Poisoning

Severity Score

8.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.

Las versiones de HaloITSM hasta 2.146.1 se ven afectadas por una vulnerabilidad de envenenamiento por restablecimiento de contraseña. Se pueden enviar enlaces de restablecimiento de contraseña envenenados a usuarios existentes de HaloITSM (siempre que se conozca su dirección de correo electrónico). Cuando se accede a estos enlaces envenenados (por ejemplo, manualmente por parte de la víctima o automáticamente mediante un software de cliente de correo electrónico), el token de restablecimiento de contraseña se filtra al actor malintencionado, lo que le permite establecer una nueva contraseña para la cuenta de la víctima. Esto potencialmente conduce a la apropiación de la cuenta. Las versiones de attack.HaloITSM posteriores a la 2.146.1 (y los parches a partir de la 2.143.61) corrigen la vulnerabilidad mencionada.

*Credits: Damian Pfammatter, Cyber-Defence Campus (armasuisse)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-06-20 CVE Reserved
  • 2024-08-06 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-08-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-640: Weak Password Recovery Mechanism for Forgotten Password
CAPEC
References (1)
URL Tag Source
https://haloitsm.com/guides/article/?kbid=2155
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Halo Service Solutions
Search vendor "Halo Service Solutions"
 HaloITSM
Search vendor "Halo Service Solutions" for product "HaloITSM"
 < 2.146.1
Search vendor "Halo Service Solutions" for product "HaloITSM" and version " < 2.146.1"
en
Affected