Weak Password Recovery Mechanism for Forgotten Password
CWE-640
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
We track 178 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7. 1 has been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- Architecture and Design: Do not use standard weak security questions and use several security questions.
- Architecture and Design: Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
- Architecture and Design: Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
- Architecture and Design: Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Latest Weak Password Recovery Mechanism for Forgotten Password vulnerabilities
- 7.5 High severity
dir-823g: Weak Password Recovery Mechanism for Forgotten Password
D-Link DIR-823G firmware version 1.02B05 has a password reset vulnerability, which originates from the SetMultipleActions API, allowing unauthorized attackers to reset the WEB page management password.
- 9.8 Critical severity
Student Management System: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument s
- 8.8 High severity
Mivoice Connect: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial install
- 9.8 Critical severity
NVR MS-Nxxxx-xxG: Weak Password Recovery Mechanism for Forgotten Password
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exp
- 7.8 High severity
Serene: Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time t
- 9.8 Critical severity
Cf-wr623n Firmware: Weak Password Recovery Mechanism for Forgotten Password
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeover. Anyone can reset the password of the admin accounts.
- 7.5 High severity
Trufusion Enterprise: Weak Password Recovery Mechanism for Forgotten Password
The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.
- 9.8 Critical severity
SICK SIM2000ST (LFT PPC): Missing Authentication for Critical Functionality
Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This
- 9.8 Critical severity
moneo appliance: Weak Password Recovery Mechanism for Forgotten Password
In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.
- 9.8 Critical severity
Backclick: Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for any account and set a new password.
- 9.8 Critical severity
EcoStruxure Control Expert: Weak Password Recovery Mechanism for Forgotten Password
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Un
- 8.1 High severity
countly-server: Weak Password Recovery Mechanism for Forgotten Password
countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password re
- 8.8 High severity
Craft CMS: Weak Password Recovery Mechanism for Forgotten Password
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionali
- 7.5 High severity
shopware: Weak Password Recovery Mechanism for Forgotten Password
Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take ov
- 9.8 Critical severity
Automatic Question Paper Generator: Weak Password Recovery Mechanism for Forgotten Password
A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can be launched remotely.
- 7.5 High severity
xwiki-platform: Weak Password Recovery Mechanism for Forgotten Password
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to gu
- 9.8 Critical severity
Enterprise Identity Cloud: Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthenticated user to reset passwords and login as any local account.
- 7.4 High severity
Umbraco CMS: Inconsistent Interpretation of HTTP Requests
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server the