Description Preview
InfiniteWP Admin Panel versions prior to 3.1.12.3 contain a vulnerability in the password reset functionality. The resetPasswordSendMail function generates password-reset codes with insufficient entropy, making them predictable. This weakness allows remote attackers to potentially guess valid reset codes and take over administrator accounts without authorization.
Overview
This vulnerability (CVE-2020-28642) affects the InfiniteWP Admin Panel, a tool used to manage multiple WordPress websites from a single dashboard. The issue stems from the implementation of the resetPasswordSendMail function which generates password reset codes with insufficient randomness (CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator). Attackers can exploit this weakness to predict valid password reset codes, allowing unauthorized access to administrator accounts. The vulnerability is particularly severe as it could lead to complete compromise of all WordPress sites managed through the affected InfiniteWP instance.
Remediation
To address this vulnerability, system administrators should:
- Update InfiniteWP Admin Panel to version 3.1.12.3 or later immediately
- Review access logs for any suspicious password reset attempts
- Change administrator passwords after the update
- Consider implementing additional security measures such as two-factor authentication if available
- Limit access to the InfiniteWP Admin Panel to trusted IP addresses where possible
References
- WhiteHack Security Advisory: https://www.whitehack.de/advisories/HWADV2020-001.txt
- CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator - https://cwe.mitre.org/data/definitions/338.html
- MITRE CVE-2020-28642: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28642
- InfiniteWP Security Updates: https://infinitewp.com/docs/security-updates/
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
