Weak Password Recovery Mechanism for Forgotten Password
CWE-640
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
We track 178 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Architecture and Design: Do not use standard weak security questions and use several security questions.
- Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
- Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
- Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Latest Weak Password Recovery Mechanism for Forgotten Password vulnerabilities
- 9.8 Critical severity
Directorist: AI-Powered Business Directory…: Weak Password Recovery Mechanism for Forgotten Password
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 8.1. This is due to the directorist_generate_password_reset
- 9.8 Critical severity
Nameless: Weak Password Recovery Mechanism for Forgotten Password
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. A user with admincp.core.emails or admincp.users.edit permissions can validate users and an attacker can reset their password. When the account is successfully approved by ema
- 9.8 Critical severity
AdForest: Weak Password Recovery Mechanism for Forgotten Password
The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6. This is due to the plugin not properly validating a user's identity prior to updating their password through the adforest_r
- 9.8 Critical severity
Reyee OS: Weak Password Recovery Mechanism for Forgotten Password
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks.
- 9.8 Critical severity
Contest Gallery – Upload & Vote Photos, Media…: Weak Password Recovery Mechanism for Forgotten Password
The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes i
- 8.1 High severity
Security SOAR: Weak Password Recovery Mechanism for Forgotten Password
IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.
- 9.8 Critical severity
App Builder – Create Native Android & iOS Apps…: Weak Password Recovery Mechanism for Forgotten Password
The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verify_otp_forgot_password() and update_password()
- 9.8 Critical severity
AppPresser – Mobile App Framework: Weak Password Recovery Mechanism for Forgotten Password
The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enoug
- 8.8 High severity
meanstore: Weak Password Recovery Mechanism for Forgotten Password
A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.
- 9.8 Critical severity
Netman 204: Weak Password Recovery Mechanism for Forgotten Password
The password recovery mechanism for the forgotten password in Riello Netman 204 allows an attacker to reset the admin password and take over control of the device.This issue affects Netman 204: through 4.05.
- 9.8 Critical severity
TDuckPro: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed
- 8.0 High severity
staff_appraisal_system: Weak Password Recovery Mechanism for Forgotten Password
A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromi
- 8.1 High severity
HaloITSM: Weak Password Recovery Mechanism for Forgotten Password
HaloITSM versions up to 2.146.1 are affected by a Password Reset Poisoning vulnerability. Poisoned password reset links can be sent to existing HaloITSM users (given their email address is known). When these poisoned links get accessed (e.g. manually by the vi
- 9.8 Critical severity
turbomeeting: Weak Password Recovery Mechanism for Forgotten Password
The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit value.
- 8.1 High severity
OTP Login With Phone Number, OTP Verification: Weak Password Recovery Mechanism for Forgotten Password
The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time l
- 9.8 Critical severity
Build App Online: Weak Password Recovery Mechanism for Forgotten Password
The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by gu
- 7.5 High severity
lunary-ai/lunary: Weak Password Recovery Mechanism for Forgotten Password
In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's
- 8.8 High severity
Tapo C210: Weak Password Recovery Mechanism for Forgotten Password
TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link Tapo C210 IP cameras. Authentication is not required to exploit this vul
- 7.5 High severity
meet: Weak Password Recovery Mechanism for Forgotten Password
In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeting password when a user is invited to a call after waiting in the lobby.
- 8.8 High severity
SAP NetWeaver AS Java User Management Engine: Weak Password Recovery Mechanism for Forgotten Password
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on co
- 8.0 High severity
CDeX: Weak Password Recovery Mechanism for Forgotten Password
Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions through 5.7.1.
- 8.0 High severity
Secure Connect Gateway (SCG) Policy Manager: Weak Password Recovery Mechanism for Forgotten Password
Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the
- 8.8 High severity
PowerProtect Data Manager: Weak Password Recovery Mechanism for Forgotten Password
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to the applicat
- 7.5 High severity
ERP: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is possible to launch t
- 9.8 Critical severity
GitLab Community and Enterprise Editions Improper Access Control Exploited
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password
- 7.5 High severity
CMS: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. The
- 8.8 High severity
AVideo: Weak Password Recovery Mechanism for Forgotten Password
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to an arbitrary user password recovery. An attacker can send an
- 8.1 High severity
Host Reseller System: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password recov
- 8.1 High severity
SAP Commerce Cloud: Weak Password Recovery Mechanism for Forgotten Password
In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Com
- 8.8 High severity
zitadel: Weak Password Recovery Mechanism for Forgotten Password
ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten an
- 9.8 Critical severity
AppPresser – Mobile App Framework: Weak Password Recovery Mechanism for Forgotten Password
The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit.
- 9.8 Critical severity
Emsigner: Weak Password Recovery Mechanism for Forgotten Password
Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token.
- 8.8 High severity
PILOS: Weak Password Recovery Mechanism for Forgotten Password
PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to ma
- 7.5 High severity
RockOA: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password
- 7.4 High severity
jumpserver: Weak Password Recovery Mechanism for Forgotten Password
JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users a
- 8.2 High severity
Arconte Áurea: Weak Password Recovery Mechanism for Forgotten Password
Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user.
- 7.8 High severity
HR Portal: Weak Password Recovery Mechanism for Forgotten Password
Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with
- 7.5 High severity
Password Recovery Plugin: Weak Password Recovery Mechanism for Forgotten Password
Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic s
- 9.8 Critical severity
RapidCMS: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may
- 7.8 High severity
Endpoint Detection And Response: Weak Password Recovery Mechanism for Forgotten Password
The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an executable file in a debugg