Ubuntu notice USN-8993-1 flags SOGo flaw in password reset links
VULNERABILITYredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
USN-8993-1 covers SOGo, which uses the client-supplied Origin header when constructing password reset links, so a remote attacker may be able to obtain reset tokens and take over accounts. The article gives no CVE ID or affected and fixed versions. Defenders should apply the SOGo update referenced in the Ubuntu notice and review password reset activity.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Apply the SOGo update referenced in Ubuntu security notice USN-8993-1.
- Review recent password reset activity for signs of unexpected account changes.
Written by AI from the sources, checked against them
Full story timeline · 1 update
- Tue 3 NovemberUSN-8993-1: SOGo vulnerabilityUbuntu Security Notices
Who reported · 1 outlet
Ubuntu Security Notices