GHSA-2m5g-8xpw-42vp json
OpenCFP Framework (Sentry) Account takeover via null password reset codes
published 2y ago modified 3mo ago
- cvss
- 8.9
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
OpenCFP, an open-source conference talk submission system written in PHP, contains a security vulnerability in its third-party authentication framework, Sentry, developed by Cartalyst. The vulnerability stems from how Sentry handles password reset checks. Users lacking a password reset token stored in the database default to having NULL in the reset_password_code column. Exploiting this flaw could allow unauthorized manipulation of any OpenCFP user's password, particularly those without an unused password reset token. Although successful login still requires correlating the numeric user ID with an email address, the identification of likely organizers (users 1-5) may facilitate this process.
Patch / fix
- packagist cartalyst/sentry 2.1.7
Is GHSA-2m5g-8xpw-42vp in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 8.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | cartalyst/sentry | <2.1.7 |
2.1.7 |
References
-
github.com
/cartalyst/sentry/commit/c679730b8848686f59125cd821bf94946fb16a94
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/cartalyst/sentry/2016-09-05.yaml
web
-
github.com
/cartalyst/sentry
package
-
github.com
/cartalyst/sentry/releases/tag/v2.1.7
web
-
haxx.ml
/post/149975211631/how-i-hacked-your-cfp-and-probably-some-other
web
-
web.archive.org
/web/20180119075946/https://haxx.ml/post/149975211631/how-i-hacked-your-cfp-and-probably-some-other
web
Sources
- GitHub Advisory GHSA-2m5g-8xpw-42vp
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.