CVE-2024-11717
Severity CVSS v4.0:
MEDIUM
Type:
Unavailable / Other
Publication date:
02/01/2025
Last modified:
15/04/2026
Description
Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to change user&#39;s password and take over the account. Moreover, the tokens also include base64 encoded user email.<br />
<br />
This issue impacts releases up to 3.7.4 and was addressed by pull request 2679 https://github.com/CTFd/CTFd/pull/2679 included in 3.7.5 release.
Impact
Base Score 4.0
6.30
Severity 4.0
MEDIUM