CVE-2024-6203 HaloITSM - Password Reset Poisoning
Attackers can poison password reset links to leak tokens and take over user accounts in HaloITSM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-6203?
CVE-2024-6203 is a high-severity authentication bypass vulnerability in HaloITSM, published on 6 Aug 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Weakness: CWE-640
Which versions are affected by CVE-2024-6203?
It affects 1 product.
Products include Haloservicesolutions Haloitsm.
How do I fix CVE-2024-6203?
No fix has been published for CVE-2024-6203 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-6203 being exploited?
There is no known exploitation of CVE-2024-6203 in the wild and no public exploit code.
Other vulnerabilities in HaloITSM
Sources
Also known as GHSA-q664-v9r4-qmrg.