Fleet: Password reset tokens remain valid after password change for 24 hours
Résumé
Fleet: Password reset tokens remain valid after password change for 24 hours
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale password reset token could be reused to reset the account password even after a defensive password change. Version 4.81.0 patches the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov