Wallos Password Reset Page Exposes User Data to Malicious Attacks

Summary

An attacker could potentially steal user login information by exploiting a security flaw in the Wallos password reset page. This issue has been fixed in version 4.6.2, which should be updated to prevent this type of attack. Users should check their version and apply the update if necessary.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
wallosapp	wallos	<= 4.6.2	–

Original title

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes ...

Original description

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $_GET["token"] and $_GET["email"] directly into HTML input value attributes using <?= $token ?> and <?= $email ?> without calling htmlspecialchars(). This allows reflected XSS by breaking out of the attribute context. This issue has been patched in version 4.6.2.

nvd CVSS4.0 6.9

Vulnerability type

CWE-79 Cross-site Scripting (XSS)