vulnwire
7.2high

CVE-2017-18486

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter.

Published 7 y ago · modified 4 mo ago · JSON

CVSS
7.2
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.8%
percentile 92%
Public exploits
0
none known

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.

Exploit prediction (EPSS)

4.81% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.2CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-332 Insufficient Entropy in PRNG

References

  • trustedsec.com /2017/09/full-disclosure-jitbit-helpdesk-authentication-bypass-0-day · x_refsource_MISC, x_transferred
  • github.com /Kc57/JitBit_Helpdesk_Auth_Bypass · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/42776 · x_refsource_MISC, x_transferred
  • packetstormsecurity.com /files/144334/JitBit-Helpdesk-9.0.2-Broken-Authentication.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.