Weakness (CWE)
CWE-640: Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
How to prevent it (6 mitigations)
-
Architecture and Design
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
-
Architecture and Design
Do not use standard weak security questions and use several security questions.
-
Architecture and Design
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
-
Architecture and Design
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
-
Architecture and Design
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
-
Architecture and Design
Assign a new temporary password rather than revealing the original password.
Source: MITRE CWE-640
270 results · Feed
-
Medium 6.4
Multiple valid tokens for password reset in Shopware
Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be requested. All tokens can be used to change the password. This makes it possible for an attacker to take o…
-
High 7.3
Automatic Question Paper Generator password recovery
A vulnerability was found in Automatic Question Paper Generator 1.0. It has been declared as critical. An attack leads to privilege escalation. The attack can be launched remotely.
-
High 7.3
Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber
Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.
-
Medium 5.3
Information exposure in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to g…
-
High 8.8
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
-
Medium 6.8
Umbraco Password Reset URL Poison
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server th…
-
High 8.0
SuiteCRM - Account Takeover in Password Reset Functionality
In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same…
-
High 8.8
Account Takeover in "Dolibarr" via Password Reset Functionality
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email whe…
-
Medium 5.3
Re-use of email tokens in Discourse
Discourse is an open-source platform for community discussion. In Discourse before versions 2.7.8 and 2.8.0.beta4, when adding additional email addresses to an existing account on a Discourse site an email token is generated as part of the email verification …
-
Medium 5.4
Akaunting Password Reset Relay
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in …
-
High 7.5
Liferay Portal and Liferay DXP insecure default configuration
Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be default…
-
Critical 9.8
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogi…
-
Unscored —
Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSE…
-
High 8.1
Weak Password Recovery Mechanism for Forgotten Password in Strapi
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
-
High 7.5
Indico Tampering with links (e.g. password reset) in sent emails
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
-
Medium 5.1
Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assis…
-
Critical 9.8
Mattermost Server password reset email requests can be sent to attacker-provided email addresses
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
-
Unscored —
In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the…
-
Critical 9.8
Django Potential account hijack via password reset form
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…
-
Critical 9.8
Strapi allows unauthenticated attacker to reset admin password without valid reset token
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
-
Critical 9.8
Craft CMS possibility of brute force attempts
In Craft CMS through 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them.
-
Critical 9.8
Contao Does Not Invalidate Existing Sessions When Password Changes
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
-
Unscored —
A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be us…
-
High 8.8
ASP.NET Core allow an elevation of privilege
ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
-
Critical 9.8
Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.
-
Low 3.7
Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset Links are not expired after the user changes their current email address to a new o…
-
Medium 5.3
Craft CMS subject to URL forgery
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
-
High 8.8
MantisBT allows arbitrary password reset
MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.
-
High 7.5CVE-2017-5594 Public exploit
Pagekit Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID …
-
High 7.3
Moodle Weak Password Recovery Mechanism for Forgotten Password
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.