Skip to content
OpenAdvisories
High ICSA-23-199-04 4 CVEs

Weintek Weincloud

Published Jul 18, 2023 · Updated Jul 18, 2023

Vendor: Weintek Product: Account API

Summary

Successful exploitation of these vulnerabilities could allow an attacker to utilize the JSON web token (JWT) to reset account passwords, use expired credentials, perform brute force attacks on credentials, or cause a denial-of-service condition.

Vulnerabilities 4

  • High 7.5
    CVE-2023-34429

    Weintek Weincloud Improper Handling of Structural Elements

    Weintek Weincloud v0.13.6 could allow an attacker to cause a denial-of-service condition for Weincloud by sending a forged JWT token.

    Weintek Weincloud
  • High 7.4
    CVE-2023-35134

    Weintek Weincloud Weak Password Recovery Mechanism for Forgotten Password

    Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.

    Weintek Weincloud
  • High 7.2
    CVE-2023-37362

    Weintek Weincloud Improper Authentication

    Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website.

    Weintek Weincloud
  • Medium 5.3
    CVE-2023-32657

    Weintek Weincloud Improper Restriction of Excessive Authentication Attempts

    Weintek Weincloud v0.13.6 could allow an attacker to efficiently develop a brute force attack on credentials with authentication hints from error message responses.

    Weintek Weincloud

Revision history

  1. #1

    Initial Publication

References