Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

cartalyst/sentry

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.9PackagistPublished

    OpenCFP Framework (Sentry) Account takeover via null password reset codes

    GHSA-2m5g-8xpw-42vp

    Affected
    • Packagist cartalyst/sentry < 2.1.7
    Fixed in
    2.1.7· Vendor fix available
    Issue
    OpenCFP, an open-source conference talk submission system written in PHP, contains a security vulnerability in its third-party authentication framework, Sentry, developed by Cartalyst. The vulnerability stems from how Sentry handles password reset checks. Users lacking a password reset token stored in the database default to having NULL in the resetpasswordcode column. Exploiting this flaw could allow unauthorized manipulation of any OpenCFP user's password, particularly those without an unused password reset token. Although successful login still requires correlating the numeric user ID with an email address, the identification of likely organizers (users 1-5) may facilitate this process.

    Recommended action: Upgrade to 2.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →