References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticated user to recover another local account's reset code and complete the normal password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator. This issue is fixed in version 2.3.2.

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-862

https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b

https://github.com/Termix-SSH/Termix/pull/874

https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag

https://github.com/Termix-SSH/Termix/security/advisories/GHSA-6r97-7wp3-2g3x

[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":"< 2.3.2","status":"affected"}]}]