[CVE-2023-49032] Hijack SMS codes to an arbitrary phone number about self-service-password HOT 8 CLOSED

Of course, write to clement.oudot at worteks.com

from self-service-password.

Of course, write to clement.oudot at worteks.com

Thanks, I just sent you the email from my corporate mailbox. I am waiting for your feedback. thank you.

from self-service-password.

Hello @piuppi

bug confirmed and patch provided privately. It will be published in 1.5.4 which should be released very soon.

from self-service-password.

Applied in master with commit eddde9f and commit 603a509

from self-service-password.

Hello @coudot

thank you for confirming the bug and providing the patch privately. I also wanted to inform you that I have initiated the process of requesting a CVE for this vulnerability to ensure that it is properly documented and tracked. I appreciate your efforts in addressing this issue, and I look forward to the public release of version 1.5.4 with the implemented patch. If there are any additional steps or information needed from my side, please let me know. Thank you again for your prompt response.

from self-service-password.

@piuppi Version 1.5.4 was released today: https://github.com/ltb-project/self-service-password/releases/tag/v1.5.4

Please let me know if you got a CVE number

from self-service-password.

@coudot I made the request, I'm waiting for the CVE ID to be assigned to me. As soon as I have news I'll write to you here

from self-service-password.

Hello @coudot, MITRE assigned CVE-2023-49032. Regards.

from self-service-password.