Insufficient token expiration in Serenity
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Serenity.Net.Core | < 6.7.0 | 6.7.0 |
| .NET (NuGet) | Serenity.Net.Web | < 6.7.0 | 6.7.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-31287
- https://github.com/serenity-is/Serenity/commit/11b9d267f840513d04b4f4d4876de7823a6e48d2
- https://github.com/serenity-is/Serenity
- https://packetstorm.news/files/id/172648
- http://packetstormsecurity.com/files/172648/Serenity-StartSharp-Software-File-Upload-XSS-User-Enumeration-Reusable-Tokens.html
- http://seclists.org/fulldisclosure/2023/May/14
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-640- Platform
- .NET (NuGet)
- Package
Serenity.Net.Core, Serenity.Net.Web- Disclosed
- 27.04.2023
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2hp9-3xfr-r9w2 - CC BY 4.0
Vulnerability history: Serenity.Net.Web
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2023 04.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
Disclosures per year
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 0
-
Insufficient token expiration in Serenity this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.