CyberRota Analysis
AI-GeneratedThe vulnerability affects the Password Reset Endpoint in Automad versions up to 2.0.0-beta.32, allowing remote attackers to manipulate the requestPasswordResetToken function, leading to observable discrepancies in responses. Although the exploit complexity is rated as high, the public disclosure of the vulnerability may increase the risk of exploitation. Users of affected versions should prioritize upgrading to 2.0.0-beta.33 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes observable response discrepancy. The attack can be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.0.0-beta.33 is able to resolve this issue. Patch name: eac0b05dafdb0ddf8b9139dad8929aaba86568ca. You should upgrade the affected component.