critical9.8
CVE-2021-31646
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote).
Impact
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses a weak algorithm for the generation of password recovery tokens (the PHP uniqueid function), allowing a brute force attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gestsup | Gestsup | before 3.2.10 |
Weakness classification
References
- NVD record
- CVE.org record
- https://dojo.maltem.ca/public/advisories/CVE-2021-31646.html
- https://gestsup.fr/index.php?page=download
- https://gestsup.fr/index.php?page=download&channel=beta&version=3.2.10&type=patch
- https://dojo.maltem.ca/public/advisories/CVE-2021-31646.html
- https://gestsup.fr/index.php?page=download
- https://gestsup.fr/index.php?page=download&channel=beta&version=3.2.10&type=patch