Vulnerability in Ctfd
CVE-2024-11717
Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expir…
EPSS: 0.006 (46.7th percentile) — read the EPSS interpretation.
Affected products
- Ctfd — versions 0
Weakness classification (CWE)
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)
- cvd@cert.pl (patch)
- cvd@cert.pl (vendor-advisory)
- cvd@cert.pl (mailing-list, exploit)
- af854a3a-2127-422b-91ae-364da2661108