CVEvulnerability
CVE-2017-17097
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-01-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-640
Description
gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which makes it easier for remote attackers to obtain access by predicting this new password. This is related to the use of gmdate for password creation in fn_connect.php.
Affected configurations
• gps-server gps tracking software 2.1.1
• gps-server gps tracking software 2.1.2
• gps-server gps tracking software 2.1.3
• gps-server gps tracking software 2.1.4
• gps-server gps tracking software 2.1.5
• gps-server gps tracking software 2.1.6
• gps-server gps tracking software 2.1.7
• gps-server gps tracking software 2.1.8
• gps-server gps tracking software 2.1.9
• gps-server gps tracking software 2.2
• gps-server gps tracking software 2.2.1
• gps-server gps tracking software 2.2.2
• gps-server gps tracking software 2.2.5
• gps-server gps tracking software 2.2.7
• gps-server gps tracking software 2.3
• gps-server gps tracking software 2.3.2
• gps-server gps tracking software 2.3.5
• gps-server gps tracking software 2.4
• gps-server gps tracking software 2.4.5
• gps-server gps tracking software 2.5
• gps-server gps tracking software 2.5.5
• gps-server gps tracking software 2.5.7
• gps-server gps tracking software 2.5.8
• gps-server gps tracking software 2.5.9
• gps-server gps tracking software 2.6
• gps-server gps tracking software 2.7
• gps-server gps tracking software 2.8
• gps-server gps tracking software 2.8.5
• gps-server gps tracking software 2.9
• gps-server gps tracking software 2.9.1
• gps-server gps tracking software 2.9.2
• gps-server gps tracking software 2.9.5
• gps-server gps tracking software 2.9.6
Related
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
References
- https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec Patch, Third Party Advisory
- https://s1.gps-server.net/changelog.txt Release Notes, Vendor Advisory
- https://www.exploit-db.com/exploits/43431/ Exploit, Third Party Advisory, VDB Entry
- https://gist.github.com/pak0s/ea7a80c2614d9cd43cfb8230c65c9fec Patch, Third Party Advisory
- https://s1.gps-server.net/changelog.txt Release Notes, Vendor Advisory
- https://www.exploit-db.com/exploits/43431/ Exploit, Third Party Advisory, VDB Entry