Executive Summary

This vulnerability exists in Vikunja, an open-source self-hosted task management platform, in versions prior to 2.0.0. The application allowed users to set weak passwords such as "1234" or "password" without enforcing any minimum password strength requirements. Additionally, when a user changed their password, their active sessions remained valid. This means that if an attacker compromised an account through brute-force attacks or credential stuffing, they could maintain persistent access to the account even after the legitimate user reset their password.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have a significant impact by allowing attackers to gain and maintain unauthorized access to user accounts. Because weak passwords are permitted, accounts are more susceptible to brute-force or credential stuffing attacks. Furthermore, the failure to invalidate active sessions after a password change means that attackers who have already compromised an account can continue to access it despite the victim's attempt to secure their account by changing the password. This can lead to unauthorized access to sensitive task management data and potential misuse of the platform.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Vikunja to version 2.0.0 or later, as this version contains the fix that enforces minimum password strength requirements and invalidates active sessions after password changes.

Useful 0 Not Useful 0