Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. The attacker must know the email address of a valid account on the site, and the actual user must blindly click the link in their email even though they didn't request the reset.
This has been fixed in 6.3.3 and 5.73.10.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Statamic Statamic
cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*
|
— |
5.73.10
|
|
Statamic Statamic
cpe:2.3:a:statamic:statamic:*:*:*:*:*:*:*:*
|
6.0.0
|
6.3.3
|
References 6
https://github.com/statamic/cms/commit/6fdd03324982848e8754f2edd2265262d361714e
security-advisories@github.com
https://github.com/statamic/cms/commit/78e63dfcf705b116d5ac0f7f7f5a1a69be63d1be
security-advisories@github.com
https://github.com/statamic/cms/commit/b2be592ddfb588bcb88c9be454f3590e14b145b0
security-advisories@github.com
https://github.com/statamic/cms/releases/tag/v5.73.10
security-advisories@github.com
https://github.com/statamic/cms/releases/tag/v6.3.3
security-advisories@github.com
https://github.com/statamic/cms/security/advisories/GHSA-jxq9-79vj-rgvw
security-advisories@github.com