TI-2023-24460 Aliases CVE-2023-45659

Session is not expiring after password reset in Engelsystem

MEDIUM 50CWE-613Published 2023-10-16 · Updated 2024-09-13

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00252 16th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
engelsystem	engelsystem	< dbb089315ff3d	—	No fix listed	CNA

engelsystem Vendorengelsystem Affected < dbb089315ff3d Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:engelsystem:engelsystem::::::::	before 2023-09-18	Vulnerable	engelsystem

cpe:2.3:a:engelsystem:engelsystem:*:*:*:*:*:*:*:* Versions before 2023-09-18 Vulnerable ·engelsystem

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-45659

References

Exploit 1

https://github.com/engelsystem/engelsystem/security/advisories/GHSA-f6mm-3v2h-jm6x

Patch 1

https://github.com/engelsystem/engelsystem/commit/dbb089315ff3d8aabc11445e78fb50765208b27d

TI-2023-24173 Blind Server Side Request Forgery (SSRF) in remote schedule import feature in Engelsystem CVSS 3.1LOW 2.3
TI-2018-13604 Engelsystem before commit hash 2e28336 allows CSRF. CVSS 3.0HIGH 8.8
TI-2023-27820 Stored XSS in Overview and Output fields CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences