Description (CNA)
PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated attackers to bypass expire_after_views limits. Attackers can send concurrent requests to the show endpoint to access one-time secrets multiple times before the view count is incremented and the push expires.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| pglombardo / PasswordPusher | affected 0 before 2.11.1; unaffected 2.11.1 |
CWE
CWE-362
References
- https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-6q3c-57pp-wvpp
- https://www.vulncheck.com/advisories/passwordpusher-before-2.11.1-race-condition-view-limit-bypass
ADP enrichment
No English description supplied.