Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
概要
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web vikunja.io