SOGo vulnerability in password reset links
Original title: USN-8993-1: SOGo vulnerability
SOGo uses client-supplied Origin header for password reset links, allowing remote attackers to obtain tokens and take over user accounts.
Ubuntu Security Notices report an issue in SOGo where the client-supplied Origin header is used when constructing password reset links. A remote attacker could possibly use this to obtain password reset tokens and take over user accounts.
- SOGo Origin header for password resets
- Remote token theft possible
- User account takeover risk
Impact: obtain password reset tokens
From the original article
It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.