Description (CNA)
LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ltb-project / LDAP Tool Box Self Service Password | affected 1.5.2 |
CWE
CWE-640
References
- https://www.exploit-db.com/exploits/51275
- https://github.com/ltb-project/self-service-password
- https://www.vulncheck.com/advisories/ldap-tool-box-self-service-password-account-takeover-via-http-host-header
ADP enrichment
No English description supplied.
No references supplied.