| Issue: |
|
|---|---|
| Date: |
|
| Severity: | High |
| Requires Admin Access: | No |
| Fix Version: | 22.12+, LTS 21.06.12+, LTS 22.03.4+ |
| Credit: | Omkar Bhagwat |
| Description: |
dotCMS password reset token is generated using an insecure method randomAlphanumeric() which is not cryptographically secure and can be brute-forced. This may lead an attacker to gain access to admin account by requesting a password reset token of herself and admin back to back. Attacker shall then receive the password reset token in email and leverages brute force technique to generate the subsequent token (which is for admin). This vulnerability was introduced in dotCMS version 5.3.0. Users of versions before that are not affected by this vulnerability report. |
| Mitigation: |
|
| References |
|