Weakness (CWE)
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
How to prevent it (6 mitigations)
-
Architecture and Design
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
-
Architecture and Design
Do not use standard weak security questions and use several security questions.
-
Architecture and Design
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
-
Architecture and Design
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
-
Architecture and Design
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
-
Architecture and Design
Assign a new temporary password rather than revealing the original password.
Source: MITRE CWE-640
270 results · Feed
-
Medium 5.3
Huaxia ERP UserController.java password recovery
A vulnerability classified as problematic has been found in Huaxia ERP up to 3.1. Affected is an unknown function of the file src/main/java/com/jsh/erp/controller/UserController.java. The manipulation leads to weak password recovery. It is possible to launch …
-
Critical 10.0
Weak Password Recovery Mechanism for Forgotten Password in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account passwor…
KEV May 1, 2024 -
Medium 5.3
ForU CMS password recovery
A vulnerability classified as critical was found in ForU CMS up to 2020-06-23. This vulnerability affects unknown code of the file /admin/index.php?act=reset_admin_psw. The manipulation leads to weak password recovery. The attack can be initiated remotely. Th…
-
High 8.8
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AV…
-
Medium 5.3
WWBN AVideo recovery notification bypass vulnerability
A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.
-
Low 3.7
HuiRan Host Reseller System HTTP POST Request password recovery
A vulnerability classified as problematic has been found in HuiRan Host Reseller System up to 2.0.0. Affected is an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. The manipulation leads to weak password reco…
-
High 8.1
Improper Access Control vulnerability in SAP Commerce Cloud
In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Co…
-
High 8.1
ZITADEL vulnerable account takeover via malicious host header injection
ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten a…
-
High 8.8
Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attacke…
-
Medium 4.3
Byzoro Smart S85F Management Platform login.php password recovery
A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the file /login.php. The manipulation of the argument txt_newpwd leads to weak password recovery. The exp…
-
High 8.8
PILOS account takeover through password reset poisoning
PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to m…
-
Low 3.7
JumpServer default admin user email leak password reset
JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email for initial user admin is `admin[@]mycompany[.]com`, and users reset their passwords by sending an …
-
Medium 6.5
Weak Password Recovery Mechanism for Forgotten Password in linkstackorg/linkstack
Weak Password Recovery Mechanism for Forgotten Password in GitHub repository linkstackorg/linkstack prior to v4.2.9.
-
Medium 5.3
ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting
ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly workin…
-
Medium 4.3
Xinhu RockOA Password password recovery
A vulnerability was found in Xinhu RockOA 1.1/2.3.2/15.X3amdi and classified as problematic. Affected by this issue is some unknown functionality of the file api.php?m=reimplat&a=index of the component Password Handler. The manipulation leads to weak password…
-
High 8.2
Non-MFA account takeover via brute-force attack on weak password reset code in jumpserver
JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate limiting. JumpServer provides a feature allowing users to reset forgotten passwords. Affected users …
-
High 7.8
Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password
Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with…
-
High 7.5
Vulnerability in the password recovery mechanism of Roundcube Password Recovery Plugin
Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic …
-
Medium 6.3
OpenRapid RapidCMS run-movepass.php password recovery
A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack ma…
-
High 7.4
Weintek Weincloud Weak Password Recovery Mechanism for Forgotten Password
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.
-
Unscored —
The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by exe…
-
Unscored —
The password reset function in ILIAS 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take o…
-
Unscored —
This issue was addressed with improved state management. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, …
-
Unscored —
A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. A user may acciden…
-
Medium 6.5
ningzichun Student Management System Password Reset resetPassword.php password recovery
A vulnerability was found in ningzichun Student Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file resetPassword.php of the component Password Reset Handler. The manipulation of the argument …
-
High 8.8
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier cou…
-
Critical 9.8
Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could ex…
-
Medium 5.3
Missing rate limit for password resets
Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.
-
High 7.8
Insufficient token expiration in Serenity
An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time …
-
Medium 5.3
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered…
-
Critical 9.8
An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via in…
-
Critical 9.8
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnera…
-
High 8.3
Password reset interception via API
AMI Megarac Password reset interception via API
-
Low 2.6
gitter-badger ezpublish-modern-legacy forgotpassword.php password recovery
A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an…
-
High 7.5
In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed …
-
Critical 9.8
Weak Password Recovery in ifm moneo appliance
In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.
-
Critical 9.8
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthentic…
-
Critical 9.8
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized a…
-
High 8.1
Predictable password reset token may lead to account takeover in countly-server
countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password r…
-
High 8.8
Improper account password reset in Craft CMS
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functional…