Pagekit CMS Weak Password Recovery Mechanism for Forgotten Password
Summary
CVE-2017-5594: Pagekit Weak Password Recovery Mechanism for Forgotten Password. Affects pagekit/pagekit versions < 1.0.11. Fixed in 1.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pagekit CMS is a content management system that allows users to create and manage websites. It provides various features such as user management, content editing, and theme customization. However, a vulnerability has been discovered in Pagekit CMS before version 1.0.11 that affects its password recovery mechanism for forgotten passwords.
Vulnerability Detail
The vulnerability allows a remote attacker to reset the password of a registered user when the debug toolbar is enabled. By exploiting this vulnerability, an attacker can gain unauthorized access to user accounts. This vulnerability has a CVSS score of 7.5, indicating a high severity level. The SecureLayer7 ID for this vulnerability is SL7_PGKT_01.
How To Fix
Minimum fixed version
1.0.11
This is the first release that contains the fix.
composer require pagekit/pagekit:1.0.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to update the Pagekit CMS installation to the latest version to address the issue.
Conclusion
In conclusion, the Pagekit CMS Weak Password Recovery Mechanism for Forgotten Password vulnerability allows remote attackers to reset user passwords. It is crucial to update Pagekit CMS to version 1.0.11 or later and disable the debug toolbar to mitigate the risk of unauthorized access. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for pagekit/pagekit →
FAQ
Pagekit CMS is a content management system that allows users to create and manage websites.
This vulnerability allows an attacker to reset the password of a registered user, potentially gaining unauthorized access to their account.
To fix this vulnerability, update Pagekit CMS to version 1.0.11 or later and disable the debug toolbar in production environments.
There is no specific workaround available. Updating to the latest version is the recommended solution.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for pagekit/pagekit.
