cve.bz

CWE-640: Weak Password Recovery Mechanism for Forgotten Password, page 6

Filter

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

What the weakness is: CWE-640 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-640, as MITRE names them. Credits.

Ask an AI about CWE-640

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-640: Weak Password Recovery Mechanism for Forgotten Password and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/640.html and https://cve.bz/cve/cwe/640?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2021-27654EPSS 0.6%

    Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.

  2. 9.8CVE-2022-23855EPSS 1.7%

    An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthenticated user to reset passwords and login as any local account.

  3. 6.5CVE-2021-44839EPSS 0.6%

    An issue was discovered in Delta RM 1.2. It is possible to request a new password for any other account using the account ID. Using the /listes/DTsendmaildata/adm_utilisateur/send-mail.json endpoint, a user can send a JSON array with user …

  4. 7.4CVE-2022-22691EPSS 1.0%

    The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the…

  5. 4.4CVE-2021-39919EPSS 0.3%

    In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged wh…

  6. 7.5CVE-2021-44037EPSS 0.8%

    Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.

  7. 4.2CVE-2021-39899EPSS 0.3%

    In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing t…

  8. 8.0CVE-2021-25961EPSS 1.0%

    In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly create…

  9. 5.3CVE-2021-36095EPSS 0.9%

    Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.

  10. 8.8CVE-2021-25957EPSS 1.1%

    In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user receiv…

  11. 7.5CVE-2021-37693EPSS 0.8%

    Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the…

  12. 6.1CVE-2021-37541EPSS 0.5%

    In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.

  13. 7.5CVE-2021-36708EPSS 1.2%

    In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the administrative interface of the router.

  14. 9.8CVE-2021-36209EPSS 1.0%

    In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.

  15. 8.1CVE-2021-36804EPSS 1.0%

    Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This…

  16. 7.5CVE-2021-33321EPSS 1.4%

    Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.passwo…

  17. 9.8CVE-2021-22763EPSS 1.9%

    A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow a…

  18. 9.8CVE-2021-28293EPSS 1.6%

    Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password …

  19. 9.8CVE-2021-22731EPSS 1.4%

    Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information i…

  20. 8.8CVE-2021-31912EPSS 1.2%

    In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.

  21. 8.1CVE-2021-28128EPSS 1.3%

    In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.

  22. 8.1CVE-2021-29080EPSS 0.4%

    Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR854 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 before 2…

  23. 9.1CVE-2021-25323EPSS 1.3%

    The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password when changing a password.

  24. 7.6CVE-2020-5361EPSS 0.4%

    Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can gene…

  25. 7.3CVE-2020-28186EPSS 4.1%

    Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve account takeover.

  26. 7.5CVE-2020-27408EPSS 1.7%

    OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users.

  27. 9.8CVE-2020-27179EPSS 1.3%

    konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens.

  28. 8.8CVE-2020-25728EPSS 1.0%

    The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account.

  29. 9.8CVE-2020-25105EPSS 1.1%

    eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilities).

  30. 5.3CVE-2020-14016EPSS 1.6%

    An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a not_foun…

  31. 7.5CVE-2020-14015EPSS 1.4%

    An issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is emailed an activation code that allows them to reset their password. There is, however, a flaw when no activation code is supplied. The system w…

  32. 8.1CVE-2020-11027ExploitEPSS 14%

    In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has bee…

  33. 9.1CVE-2019-6560EPSS 1.1%

    In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but…

  34. 9.8CVE-2012-5686ExploitEPSS 4.8%

    ZPanel 10.0.1 has insufficient entropy for its password reset process.

  35. 9.8CVE-2012-5618EPSS 1.2%

    Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.

  36. 9.8CVE-2020-7245EPSS 1.2%

    Incorrect username validation in the registration process of CTFd v2.0.0 - v2.2.2 allows an attacker to take over an arbitrary account if the username is known and emails are enabled on the CTFd instance. To exploit the vulnerability, one …

  37. 7.5CVE-2009-5025EPSS 1.8%

    A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user.

  38. 8.8CVE-2019-20004EPSS 1.2%

    An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete…

  39. 9.8CVE-2019-19844ExploitEPSS 54%

    Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an atta…

  40. 9.8CVE-2019-17392EPSS 1.1%

    Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password because the HTTP Host header is mishandled.

  41. 9.8CVE-2019-18818ExploitEPSS 98%

    strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

  42. 9.8CVE-2019-15929EPSS 1.8%

    In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.

  43. 6.5CVE-2019-15749EPSS 1.0%

    SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account (e.g., via XSS …

  44. 5.3CVE-2019-14955EPSS 0.9%

    In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.

  45. 8.1CVE-2019-12943EPSS 1.1%

    TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names.

  46. 5.9CVE-2019-13240EPSS 1.7%

    An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.

  47. 8.8CVE-2019-10270EPSS 1.2%

    An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and the user_id parameter) to reset …

  48. 8.8CVE-2019-3787EPSS 1.1%

    Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads …

  49. 6.8CVE-2019-12476EPSS 1.5%

    An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client …

  50. 9.8CVE-2018-16988EPSS 1.6%

    An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situat…