8
CVE-2021-25961
- EPSS 0.95%
- Veröffentlicht 29.09.2021 14:15:08
- Zuletzt bearbeitet 21.11.2024 05:55:40
- Erkennungen
LoginSuiteCRM - Account Takeover in Password Reset Functionality
In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Salesagility ≫ Suite CRM Version >= 7.1.7 < 7.10.32
Salesagility ≫ Suite CRM Version >= 7.11.0 < 7.11.21
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.95% | 0.576 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8 | 2.1 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
| NIST | 6 | 6.8 | 6.4 |
AV:N/AC:M/Au:S/C:P/I:P/A:P
|
| vulnerabilitylab@mend.io | 8 | 2.1 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
CWE-640 Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
https://github.com/salesagility/SuiteCRM/commit/7124482fe07ee164923d974456ed31e45f65e513
https://github.com/salesagility/SuiteCRM/commit/f463031bee59676d7d5be53bb32d551cd70a5648
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25961