What’s Vulnerable › Vulnerabilities
CVE-2024-6203: HaloITSM - Password Reset Poisoning
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-06 · updated 2026-06-17
- Weakness: CWE-640
Description
HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the victim or automatically by an email client software), the password reset token is leaked to the malicious actor, allowing them to set a new password for the victim's account.This potentially leads to account takeover attacks.HaloITSM versions past 2.146.1 (and patches starting from 2.143.61 ) fix the mentioned vulnerability.
Affected products
- Halo Service Solutions HaloITSM: before 2.143.61; from 2.144 before 2.146.1 — fixed in 2.143.61, 2.146.1
How to fix
Upgrade to a fixed version: Halo Service Solutions HaloITSM 2.143.61, 2.146.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-6203 or the next vulnerability affects your stack