[tor-bugs] #11545 [Service - trac]: Remote password change in trac.torproject account
Tor Bug Tracker & Wiki
blackhole at torproject.org
Thu Apr 17 08:01:28 UTC 2014
#11545: Remote password change in trac.torproject account
----------------------------+---------------------
Reporter: Dedalo | Owner:
Type: defect | Status: new
Priority: critical | Milestone:
Component: Service - trac | Version:
Keywords: | Actual Points:
Parent ID: | Points:
----------------------------+---------------------
I was trying to recover my password and I tried to register my user again
so a noticed there is a vulnerability, any user can actually change any
users password.
Go to:
https://trac.torproject.org/projects/tor/register
Just put any username with the password you want and then that is going to
automatically change it.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/11545>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list