CVE-2024-6203

HIGH EPSS 28.6%
Published Aug 6, 20241y ago · Modified Jun 17, 20261w ago
8.1 CVSS 3.1
High
Find Similar
Published Aug 6, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.

CVSS Details

Base Score
8.1
Exploitability
2.8
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

EPSS Exploit Probability
28.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-640

Affected Products 2

VendorProductVersionRange
haloservicesolutionshaloitsm* <2.143.61
haloservicesolutionshaloitsm*≥2.144  –  <2.146.1

References 1

  • haloitsm.com https://haloitsm.com/guides/article/?kbid=2155
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.