CVE-2018-1000554

Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
VendorProductVersion
troveboxtrovebox
𝑥
≤ 3.0.0
troveboxtrovebox
4.0.0:rc2
troveboxtrovebox
4.0.0:rc5
troveboxtrovebox
4.0.0:rc6
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html
https://telekomsecurity.github.io/2018/04/trovebox-vulnerabilities.html