CVE-2024-30187: Medium severity Anope Anope vulnerability
Anope before 2.0.15 does not prevent resetting the password of a suspended account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/anopeto a version that resolves this vulnerability.Fixed in 2.0.4-2ubuntu0.1~ - Upgrade
Upgrade
ubuntu/anopeto a version that resolves this vulnerability.Fixed in 2.0.6-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/anopeto a version that resolves this vulnerability.Fixed in 2.0.9-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/anopeto a version that resolves this vulnerability.Fixed in 2.0.12-1ubuntu0.23.10.1 - Upgrade
Upgrade
ubuntu/anopeto a version that resolves this vulnerability.Fixed in 2.0.12-1ubuntu1 - Upgrade
Upgrade
ubuntu/anopeto a version that resolves this vulnerability.Fixed in 2.0.15-1 - Upgrade
Upgrade
ubuntu/anopeto a version that resolves this vulnerability.Fixed in 2.0.3-1ubuntu0.1~ - Upgrade
Upgrade
debian/anopeto a version that resolves this vulnerability.Fixed in 2.0.15-1 - Upgrade
Upgrade
debian/anopeto a version that resolves this vulnerability.Fixed in 2.0.17-1Fixed in 2.0.17-1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30187?
CVE-2024-30187 has a medium severity rating because it allows resetting passwords for suspended accounts, potentially leading to unauthorized access.
How do I fix CVE-2024-30187?
To fix CVE-2024-30187, upgrade Anope to version 2.0.15 or later.
Which versions of Anope are vulnerable to CVE-2024-30187?
Versions of Anope prior to 2.0.15, specifically any version below 2.0.15, are vulnerable to CVE-2024-30187.
What are the consequences of CVE-2024-30187?
The consequence of CVE-2024-30187 is that it allows attackers to potentially regain access to accounts that were meant to be suspended.
Is there a workaround for CVE-2024-30187 until I can upgrade?
A temporary workaround for CVE-2024-30187 is to monitor and manually block any password reset requests for suspended accounts.