cve.bz

CWE-640: Weak Password Recovery Mechanism for Forgotten Password, page 5

Filter

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

What the weakness is: CWE-640 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-640, as MITRE names them. Credits.

Ask an AI about CWE-640

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-640: Weak Password Recovery Mechanism for Forgotten Password and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/640.html and https://cve.bz/cve/cwe/640?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2023-50172EPSS 0.8%

    A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pas…

  2. 8.8CVE-2023-49589EPSS 0.9%

    An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An …

  3. 8.1CVE-2024-0186EPSS 0.6%

    A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads t…

  4. 8.1CVE-2023-42481EPSS 0.5%

    In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP…

  5. 8.8CVE-2023-49097EPSS 0.8%

    ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this hea…

  6. 9.8CVE-2023-4214EPSS 0.9%

    The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or…

  7. 9.8CVE-2023-43902EPSS 0.8%

    Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password rese…

  8. 4.3CVE-2023-5959EPSS 0.9%

    A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txt_newpwd leads to weak passwo…

  9. 8.8CVE-2023-47107EPSS 0.6%

    PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It …

  10. 5.3CVE-2023-46138EPSS 0.4%

    JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their pass…

  11. 8.8CVE-2023-5840EPSS 0.8%

    Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.

  12. 5.3CVE-2023-44399EPSS 0.7%

    ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings…

  13. 7.5CVE-2023-5296EPSS 0.5%

    A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation le…

  14. 7.4CVE-2023-43650EPSS 0.6%

    JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwo…

  15. 8.2CVE-2023-4096EPSS 0.4%

    Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate u…

  16. 7.8CVE-2023-34357EPSS 0.2%

    Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration da…

  17. 7.5CVE-2023-3222EPSS 0.7%

    Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could …

  18. 9.8CVE-2023-4448EPSS 0.7%

    A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password rec…

  19. 5.9CVE-2023-35134EPSS 0.5%

    Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.

  20. 7.8CVE-2023-29145EPSS 0.3%

    The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an execut…

  21. 9.8CVE-2023-36487EPSS 1.0%

    The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.

  22. 7.5CVE-2023-26615EPSS 0.9%

    D-Link DIR-823G firmware version 1.02B05 has a password reset vulnerability, which originates from the SetMultipleActions API, allowing unauthorized attackers to reset the WEB page management password.

  23. 5.5CVE-2023-28202EPSS 0.2%

    This issue was addressed with improved state management. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app firewall setting may not take effect after exiting the Settings app.

  24. 4.3CVE-2022-42807EPSS 0.4%

    A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. A user may accidentally add a participant to a Shared Album by pressing the Delete key

  25. 9.8CVE-2023-3007EPSS 1.0%

    A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulat…

  26. 8.8CVE-2023-31459EPSS 0.4%

    A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, becaus…

  27. 5.3CVE-2023-28821EPSS 0.7%

    Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

  28. 9.8CVE-2023-30466EPSS 1.1%

    This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remo…

  29. 7.8CVE-2023-31287EPSS 0.4%

    An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be…

  30. 5.3CVE-2021-36436EPSS 0.5%

    An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint.

  31. 9.8CVE-2022-45637EPSS 0.8%

    An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via insecure expiry mechanism.

  32. 9.8CVE-2022-47697EPSS 0.6%

    COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeover. Anyone can reset the password of the admin accounts.

  33. 8.8CVE-2022-26872EPSS 0.8%

    AMI Megarac Password reset interception via API

  34. 7.5CVE-2015-10071EPSS 0.6%

    A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. …

  35. 7.5CVE-2022-25027EPSS 1.1%

    The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.

  36. 7.5CVE-2020-12067EPSS 0.5%

    In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker without knowledge of the current password.

  37. 9.8CVE-2022-47377EPSS 0.9%

    Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery m…

  38. 9.8CVE-2022-3485EPSS 1.0%

    In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.

  39. 9.8CVE-2022-44004EPSS 1.3%

    An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password.

  40. 9.8CVE-2022-37300EPSS 0.8%

    A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Ex…

  41. 5.3CVE-2022-34530EPSS 0.6%

    An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.

  42. 4.3CVE-2022-23172EPSS 0.4%

    An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the syst…

  43. 8.1CVE-2022-29174EPSS 1.5%

    countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of gue…

  44. 8.8CVE-2022-29933EPSS 4.6%

    Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the passw…

  45. 7.5CVE-2022-24892EPSS 0.9%

    Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for a…

  46. 9.8CVE-2022-27157EPSS 1.2%

    pearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users/passwordmanage.php.

  47. 7.5CVE-2021-43498EPSS 1.6%

    An Access Control vulnerability exists in ATutor 2.2.4 in password_reminder.php when the g, id, h, form_password_hidden, and form_change HTTP POST parameters are set.

  48. 9.8CVE-2022-1073EPSS 0.8%

    A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can be launched remotely.

  49. 7.5CVE-2022-0777EPSS 1.2%

    Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.

  50. 7.5CVE-2022-23619EPSS 1.1%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the…