Description
LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.
Published: 2025-12-19
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 21 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Ltb-project
Ltb-project ldap Tool Box Self Service Password
Vendors & Products Ltb-project
Ltb-project ldap Tool Box Self Service Password

Fri, 19 Dec 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 19 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Description LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.
Title LDAP Tool Box Self Service Password 1.5.2 Account Takeover via HTTP Host Header
Weaknesses CWE-640
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ltb-project Ldap Tool Box Self Service Password
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-07T14:08:12.554Z

Reserved: 2025-12-19T14:03:57.724Z

Link: CVE-2023-53958

cve-icon Vulnrichment

Updated: 2025-12-19T21:31:21.960Z

cve-icon NVD

Status : Deferred

Published: 2025-12-19T21:15:52.893

Modified: 2026-04-15T00:35:42.020

Link: CVE-2023-53958

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-21T21:12:48Z

Weaknesses