Vulnerability Description
`effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on an instance of `effectindex/tripreporter`, e.g. `subjective.report`, may be affected by an improper password verification vulnerability. The vulnerability allows any user with a password matching the password requirements to log in as any user. This allows access to accounts / data loss of the user. This issue is patched in commit bd80ba833b9023d39ca22e29874296c8729dd53b. No action necessary for users of `subjective.report`, and anyone running their own instance should update to this commit or newer as soon as possible. As a workaround, someone running their own instance may apply the patch manually.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Effectindex | Tripreporter | < 2023-04-30 |
Related Weaknesses (CWE)
References
- https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e2987429Patch
- https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-hPatchVendor Advisory
- https://github.com/effectindex/tripreporter/commit/bd80ba833b9023d39ca22e2987429Patch
- https://github.com/effectindex/tripreporter/security/advisories/GHSA-356r-rwp8-hPatchVendor Advisory
FAQ
What is CVE-2023-31123?
CVE-2023-31123 is a vulnerability with a CVSS score of 9.1 (CRITICAL). `effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9023d39ca22e29874296c8729dd53b, any user with an account on a...
How severe is CVE-2023-31123?
CVE-2023-31123 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-31123?
Check the references section above for vendor advisories and patch information. Affected products include: Effectindex Tripreporter.