CVE-2017-11680

High

Published: 27/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Hashtopussy 0.4.0 has a Cross-Site Request Forgery (CSRF) vulnerability that allows an admin password change via users.php.

This vulnerability could lead to unauthorized password changes for administrators, compromising the security of the entire system.

It is recommended to upgrade to a newer version of Hashtopussy that addresses this vulnerability and to implement additional CSRF protections.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) exists in Hashtopussy 0.4.0, allowing an admin password change via users.php.