effectindex tripreporter improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in effectindex tripreporter. The impacted element is an unknown function. Performing a manipulation results in improper authentication. This vulnerability is cataloged as CVE-2023-31123. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in effectindex tripreporter (Reporting Software) (affected version not known). This affects some unknown functionality. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

`effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on an instance of `effectindex/tripreporter`, e.g. `subjective.report`, may be affected by an improper password verification vulnerability. The vulnerability allows any user with a password matching the password requirements to log in as any user. This allows access to accounts / data loss of the user. This issue is patched in commit bd80ba833b9023d39ca22e29874296c8729dd53b. No action necessary for users of `subjective.report`, and anyone running their own instance should update to this commit or newer as soon as possible. As a workaround, someone running their own instance may apply the patch manually.

The weakness was shared 05/09/2023 as GHSA-356r-rwp8-h6m6. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-31123 since 04/24/2023. The technical details are unknown and an exploit is not publicly available.

Applying the patch bd80ba833b9023d39ca22e29874296c8729dd53b is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Reporting Software

Vendor

• effectindex

Name

• tripreporter

License

• open-source

Website

• Product: https://github.com/effectindex/tripreporter/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion