CVE-2017-18486 - CVE House
Back to Database
Status published High CVE-2017-18486

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges...

Vulnerability Description

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-18486

Credits & Attribution

No credits recorded in the NVD database.

References

More from jitbit

View All →
CVE-2025-29771
HtmlSanitizer vulnerable to XSS when used with contentEditable
Medium 5.3
CVE-2019-18636
A cross-site scripting (XSS) vulnerability in Jitbit .NET Forum (aka...
Medium 5.4

Affected Vendor

Affected Software

helpdesk
Vulnerable Versions:
0

Timeline

Official Publish: August 9th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.