CVE-2021-36804: Akaunting Password Reset Relay
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36804?
CVE-2021-36804 has a medium severity rating due to the potential for unauthorized password reset functionality.
How do I fix CVE-2021-36804?
To fix CVE-2021-36804, upgrade Akaunting to version 2.1.13 or later.
What impacts does CVE-2021-36804 have on affected systems?
CVE-2021-36804 allows attackers to proxy password reset requests, potentially compromising user accounts.
Who is affected by CVE-2021-36804?
Users of Akaunting version 2.1.12 and earlier are affected by CVE-2021-36804.
What are the symptoms of an exploit of CVE-2021-36804?
Exploitation of CVE-2021-36804 may result in unauthorized password resets and account access.