Description
ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ProjectSend ProjectSend
Default version status: unaffected
2.5.0 to < 2.7.0affected
pkg:github/projectsend/projectsendReferences
- https://github.com/projectsend/projectsend/security/advisories/GHSA-4r8h-mwfm-f5f4 ↗
- https://github.com/projectsend/projectsend/commit/717852ff6a99391dbd816a2bb0bb3f40cad70f72 ↗
- https://github.com/projectsend/projectsend/releases/tag/v2.7.0 ↗
- https://github.com/projectsend/projectsend/blob/v2.6.0/app/Http/Controllers/Settings/PasswordController.php#L54-L90 ↗
- https://www.vulncheck.com/advisories/projectsend-2.5.0-before-2.7.0-unverified-password-change-via-settings-password ↗