The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token.
Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Vulnerable Products
intranda:goobi-viewer-core
References 3
https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5…
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
security-advisories@github.com
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-gj5g-4rx…
security-advisories@github.com