What’s Vulnerable › Vulnerabilities

CVE-2023-31287

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-27 · updated 2026-06-17
• Weakness: CWE-640

Description

An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.

Affected products

• Serenity Serene: before 6.7.0 — fixed in 6.7.0
• Serenity Startsharp: before 6.7.0 — fixed in 6.7.0

How to fix

Upgrade to a fixed version: Serenity Serene 6.7.0; Serenity Startsharp 6.7.0. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
• http://seclists.org/fulldisclosure/2023/May/14
• https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2
• http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
• http://seclists.org/fulldisclosure/2023/May/14
• https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2
• https://packetstorm.news/files/id/172648

Get alerted when CVE-2023-31287 or the next vulnerability affects your stack