CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.62.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CallBackery for Perl, all versions before 0.62.0, is affected: its getUserConfig, getTableData, and getAllFieldValues functions expose each user's stored password hash and admin-only notes to non-administrative users. This lets a regular user read private administrator notes about them and, if they obtain a session token, retrieve another user's password hash to attempt offline cracking.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right. A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- CallBackery
fixed in 0.62.0