Vantage6: No limit on emails sent for password/MFA reset
### Impact Users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam sender. Note resetting the MFA token requires a correct password, so the potential impact for this is very low. ### Patches No ### Workarounds No
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-24769US | — | — | ||
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API routes that send them an email. Currently… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-5549-c5q7-fj65ADVISORY
- https://github.com/vantage6/vantage6PACKAGE
- https://github.com/vantage6/vantage6/blob/main/docs/release_notes.rst#500WEB
- https://github.com/vantage6/vantage6/issues/1932WEB
- https://github.com/vantage6/vantage6/security/advisories/GHSA-5549-c5q7-fj65WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-24769ADVISORY
- https://pypi.org/project/vantage6PACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan