Description (CNA)
phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| thorsten / phpMyFAQ | affected 0 before 4.1.7; unaffected 4.1.7 |
CWE
CWE-200
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-j5w2-cwwj-xj7x
- https://www.vulncheck.com/advisories/phpmyfaq-before-authentication-bypass-via-tracking-file
ADP enrichment
No English description supplied.