Description
Ecartis 1.0.0 (formerly listar) before snapshot 20030227 allows remote attackers to reset passwords of other users and gain privileges by modifying hidden form fields in the HTML page.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | ecartis | 0.129a+1.0.0-snap20020514-1.1 | DSA-271 |
Advisories 1
- DSA-271 ecartis - unauthorized password change Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-271 vendor-advisory
- 20030227 Ecardis Password Reseting Vulnerability mailing-list
- ecartis-password-reset(11431) vdb-entry
- 20030303 Re: Ecardis Password Reseting Vulnerability mailing-list
- 6971 vdb-entry