Password Reset Poisoning Vulnerability Affects HaloITSM Versions Up to 2.146.1
CVE-2024-6203

8.1HIGH

Key Information:

Vendor

Halo Service Solutions

Status
Haloitsm
Vendor
CVE Published:
6 August 2024

What is CVE-2024-6203?

A vulnerability in HaloITSM versions up to 2.146.1 allows malicious actors to exploit password reset processes by sending poisoned links to users. If an affected user clicks on the link—whether manually or through an automated email client—the reset token becomes accessible to the attacker. This exploit facilitates unauthorized password changes, potentially leading to full account takeover. Versions following 2.146.1, including patches from 2.143.61, remediate this critical issue, underscoring the importance of timely updates and vigilance against such targeted attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

HaloITSM < 2.146.1

References

https://haloitsm.com/guides/article/?kbid=2155

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Damian Pfammatter, Cyber-Defence Campus (armasuisse)
JSON
.