cve.bz

CWE-640: Weak Password Recovery Mechanism for Forgotten Password, page 7

Filter

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

What the weakness is: CWE-640 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-50 Password Recovery Exploitation Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-640, as MITRE names them. Credits.

Ask an AI about CWE-640

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-640: Weak Password Recovery Mechanism for Forgotten Password and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/640.html and https://cve.bz/cve/cwe/640?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2019-11414EPSS 1.3%

    An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain client IP address, administrative authorization remains available to any client at that IP address, leading to complete…

  2. 9.8CVE-2019-11393EPSS 2.1%

    An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter.

  3. 9.8CVE-2019-10641EPSS 1.3%

    Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

  4. 9.8CVE-2018-16529EPSS 1.6%

    A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used to reset a password.

  5. 9.8CVE-2018-19488EPSS 4.2%

    The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's acc…

  6. 7.5CVE-2018-0696EPSS 1.1%

    OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.

  7. 9.8CVE-2018-18871EPSS 1.7%

    Missing password verification in the web interface on Gigaset Maxwell Basic VoIP phones with firmware 2.22.7 would allow a remote attacker (in the same network as the device) to change the admin password without authentication (and without…

  8. 8.1CVE-2018-1000812EPSS 2.0%

    Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/password_recovery.php that …

  9. 6.5CVE-2018-12315EPSS 0.7%

    Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password.

  10. 9.8CVE-2018-7811EPSS 3.5%

    An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the change password function of the web ser…

  11. 9.8CVE-2018-7809EPSS 2.5%

    An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the password delete function of the web ser…

  12. 9.8CVE-2018-17881EPSS 1.5%

    On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password change.

  13. 8.8CVE-2018-17401EPSS 1.2%

    The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature. NOTE: the vendor says that, to exploit this, the us…

  14. 9.8CVE-2018-17298EPSS 1.8%

    An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes its password.

  15. 8.1CVE-2018-12579EPSS 1.2%

    An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8,…

  16. 6.3CVE-2017-2614EPSS 0.3%

    When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accoun…

  17. 8.1CVE-2017-0921EPSS 1.1%

    GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the PasswordsController component resulting in potential account takeover if a victim's session is compromi…

  18. 9.8CVE-2018-1000554EPSS 1.2%

    Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack appear to be exploitable via HTTP request. This vulnerability appears to have be…

  19. 9.8CVE-2018-1000501EPSS 1.6%

    Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulner…

  20. 9.8CVE-2018-12421EPSS 2.7%

    LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constr…

  21. 8.8CVE-2018-8916EPSS 1.0%

    Unverified password change vulnerability in Change Password in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to reset password without verification.

  22. 8.8CVE-2018-11134EPSS 3.0%

    In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue managed that runs with root privileges and only allows a set of commands. One of the available comman…

  23. 5.3CVE-2018-10210EPSS 1.0%

    An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the password-reset feature.

  24. 9.8CVE-2018-10081EPSS 1.5%

    CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.

  25. 8.1CVE-2014-6412EPSS 4.6%

    WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

  26. 8.8CVE-2018-0787EPSS 9.6%

    ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".

  27. 8.8CVE-2017-12161EPSS 1.3%

    It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid re…

  28. 7.8CVE-2017-8916EPSS 0.3%

    In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail address and send a forgot password email to themselves, thereby gaining administrative access.

  29. 6.5CVE-2017-1000141EPSS 0.8%

    An issue was discovered in Mahara before 18.10.0. It mishandled user requests that could discontinue a user's ability to maintain their own account (changing username, changing primary email address, deleting account). The correct behavior…

  30. 9.8CVE-2017-17097ExploitEPSS 6.9%

    gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-based) password to the admin, which mak…

  31. 9.8CVE-2015-5172EPSS 1.2%

    Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

  32. 8.8CVE-2017-14005EPSS 1.4%

    An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a user, the application does not require the user to know the original password. An attacker who is au…

  33. 9.8CVE-2015-4689EPSS 2.3%

    Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."

  34. 7.5CVE-2015-7257ExploitEPSS 6.7%

    ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username par…

  35. 9.8CVE-2017-7551EPSS 1.4%

    389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

  36. 8.8CVE-2017-12851EPSS 1.3%

    An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.

  37. 8.8CVE-2017-12850EPSS 1.3%

    An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.

  38. 8.1CVE-2017-8613EPSS 3.6%

    Azure AD Connect Password writeback, if misconfigured during enablement, allows an attacker to reset passwords and gain unauthorized access to arbitrary on-premises AD privileged user accounts aka "Azure AD Connect Elevation of Privilege V…

  39. 7.5CVE-2017-7629EPSS 1.0%

    QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.

  40. 7.5CVE-2017-9543EPSS 1.3%

    register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm.

  41. 7.5CVE-2017-7731EPSS 1.1%

    A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature.

  42. 3.7CVE-2015-3189EPSS 0.8%

    With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current emai…

  43. 5.9CVE-2017-8295ExploitEPSS 27%

    WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arran…

  44. 5.3CVE-2017-8385EPSS 1.0%

    Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.

  45. 8.8CVE-2017-7615ExploitEPSS 91%

    MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

  46. 7.5CVE-2016-8716EPSS 0.8%

    An exploitable Cleartext Transmission of Password vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. The Change Password functionality of the Web Application transmits th…

  47. 9.8CVE-2017-2766EPSS 1.6%

    EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could po…

  48. 7.5CVE-2017-5594ExploitEPSS 7.0%

    An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. …

  49. 7.3CVE-2016-7038EPSS 1.0%

    In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.

  50. 7.5CVE-2016-2349EPSS 1.1%

    Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.