CVE-2023-26770

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26770
TaskCafe 0.3.2 lacks validation in the Cookie value. Any unauthenticated attacker who knows a registered UserID can change the password of that user.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bishopfox.com/blog/taskcafe-version-0-3-2-advisory Exploit Third Party Advisory
https://github.com/JordanKnott/taskcafe Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:taskcafe_project:taskcafe:0.3.2:*:*:*:*:*:*:*
History

27 May 2025, 19:18

Type Values Removed Values Added
First Time Taskcafe Project taskcafe
Taskcafe Project
References () https://bishopfox.com/blog/taskcafe-version-0-3-2-advisory - () https://bishopfox.com/blog/taskcafe-version-0-3-2-advisory - Exploit, Third Party Advisory
References () https://github.com/JordanKnott/taskcafe - () https://github.com/JordanKnott/taskcafe - Product
CPE cpe:2.3:a:taskcafe_project:taskcafe:0.3.2:*:*:*:*:*:*:*

07 Oct 2024, 19:36

Type Values Removed Values Added
CWE CWE-284
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

07 Oct 2024, 17:48

Type Values Removed Values Added
Summary
  • (es) TaskCafe 0.3.2 carece de validación en el valor de la cookie. Cualquier atacante no autenticado que conozca un ID de usuario registrado puede cambiar la contraseña de ese usuario.

04 Oct 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-04 19:15

Updated : 2025-05-27 19:18

NVD link : CVE-2023-26770

Mitre link : CVE-2023-26770

CVE.ORG link : CVE-2023-26770

JSON object : View

Products Affected

taskcafe_project

  • taskcafe
CWE
CWE-284

Improper Access Control