by Kastro
Paper/Archive/CVE-2020-7378

CVE-2020-7378

CRIXP OpenCRX — CRIXP OpenCRX Unverified Password Change

EPSS 3%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 85.4.854 × 2017.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020.

Affected

ProductAffectedFixed inSource
OpenCRX4.30 – 4.30–CNA
OpenCRX5.0-20200717 – 5.0-20200717–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
rapid7 (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refblog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change