Password Reset Poisoning Vulnerability Affects HaloITSM Versions Up to 2.146.1

CVE-2024-6203

What is CVE-2024-6203?

A vulnerability in HaloITSM versions up to 2.146.1 allows malicious actors to exploit password reset processes by sending poisoned links to users. If an affected user clicks on the link—whether manually or through an automated email client—the reset token becomes accessible to the attacker. This exploit facilitates unauthorized password changes, potentially leading to full account takeover. Versions following 2.146.1, including patches from 2.143.61, remediate this critical issue, underscoring the importance of timely updates and vigilance against such targeted attacks.

References