motor-admin up to 0.2.56 Password Reset escape output

Summaryinfo

A vulnerability identified as critical has been detected in motor-admin up to 0.2.56. This vulnerability affects unknown code of the component Password Reset Handler. Performing a manipulation results in escape output. This vulnerability is identified as CVE-2022-23079. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as critical has been found in motor-admin up to 0.2.56. This affects some unknown functionality of the component Password Reset Handler. The manipulation with an unknown input leads to a escape output vulnerability. CWE is classifying the issue as CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.

The weakness was released 06/22/2022 as a461b7507940a1fa062836daa89c82404fe3ecf9. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2022-23079 since 01/10/2022. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Applying the patch a461b7507940a1fa062836daa89c82404fe3ecf9 is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• motor-admin

Version

• 0.2.0
• 0.2.1
• 0.2.2
• 0.2.3
• 0.2.4
• 0.2.5
• 0.2.6
• 0.2.7
• 0.2.8
• 0.2.9
• 0.2.10
• 0.2.11
• 0.2.12
• 0.2.13
• 0.2.14
• 0.2.15
• 0.2.16
• 0.2.17
• 0.2.18
• 0.2.19
• 0.2.20
• 0.2.21
• 0.2.22
• 0.2.23
• 0.2.24
• 0.2.25
• 0.2.26
• 0.2.27
• 0.2.28
• 0.2.29
• 0.2.30
• 0.2.31
• 0.2.32
• 0.2.33
• 0.2.34
• 0.2.35
• 0.2.36
• 0.2.37
• 0.2.38
• 0.2.39
• 0.2.40
• 0.2.41
• 0.2.42
• 0.2.43
• 0.2.44
• 0.2.45
• 0.2.46
• 0.2.47
• 0.2.48
• 0.2.49
• 0.2.50
• 0.2.51
• 0.2.52
• 0.2.53
• 0.2.54
• 0.2.55
• 0.2.56

License

• open-source

Website

• Product: https://github.com/motor-admin/motor-admin/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion