CVE-2020-7245

Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one must register with a username identical to the victim's username, but with white space inserted before and/or after the username. This will register the account with the same username as the victim. After initiating a password reset for the new account, CTFd will reset the victim's account password due to the username collision.

CVSS v3 9.8 CRITICAL
CVSS v2.0 6.8 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/CTFd/CTFd/pull/1218	Third Party Advisory
https://github.com/CTFd/CTFd/releases/tag/2.2.3	Release Notes
https://github.com/CTFd/CTFd/pull/1218	Third Party Advisory
https://github.com/CTFd/CTFd/releases/tag/2.2.3	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:ctfd:ctfd:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:36

Type	Values Removed	Values Added
References	~~() https://github.com/CTFd/CTFd/pull/1218 - Third Party Advisory~~	() https://github.com/CTFd/CTFd/pull/1218 - Third Party Advisory
References	~~() https://github.com/CTFd/CTFd/releases/tag/2.2.3 - Release Notes~~	() https://github.com/CTFd/CTFd/releases/tag/2.2.3 - Release Notes

Information

Published : 2020-01-23 23:15

Updated : 2024-11-21 05:36

NVD link : CVE-2020-7245

Mitre link : CVE-2020-7245

CVE.ORG link : CVE-2020-7245

JSON object : View

Products Affected

ctfd

ctfd

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2020-7245", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2020-01-23T23:15:11.597", "references": [{"url": "https://github.com/CTFd/CTFd/pull/1218", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/CTFd/CTFd/releases/tag/2.2.3", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/CTFd/CTFd/pull/1218", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/CTFd/CTFd/releases/tag/2.2.3", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one must register with a username identical to the victim's username, but with white space inserted before and/or after the username. This will register the account with the same username as the victim. After initiating a password reset for the new account, CTFd will reset the victim's account password due to the username collision."}, {"lang": "es", "value": "La validaci\u00f3n incorrecta del nombre de usuario en el proceso de registro de CTFd v2.0.0 - v2.2.2 permite a un atacante hacerse cargo de una cuenta arbitraria si se conoce el nombre de usuario y se habilitan los correos electr\u00f3nicos en la instancia de CTFd. Para explotar la vulnerabilidad, uno debe registrarse con un nombre de usuario id\u00e9ntico al nombre de usuario de la v\u00edctima, pero con un espacio en blanco insertado antes y / o despu\u00e9s del nombre de usuario. Esto registrar\u00e1 la cuenta con el mismo nombre de usuario que la v\u00edctima. Despu\u00e9s de iniciar un restablecimiento de contrase\u00f1a para la nueva cuenta, CTFd restablecer\u00e1 la contrase\u00f1a de la cuenta de la v\u00edctima debido a la colisi\u00f3n del nombre de usuario."}], "lastModified": "2024-11-21T05:36:54.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ctfd:ctfd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5C47875-21C5-4DA1-822C-03F195DE127B", "versionEndIncluding": "2.2.2", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}