by Kastro
Paper/Archive/CVE-2022-26314

CVE-2022-26314

Siemens Mendix Forgot Password Appstore module — A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password A…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.1.741 × 2014.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.

Affected

ProductAffectedFixed inSource
Mendix Forgot Password Appstore moduleAll versions >= V3.3.0 < V3.5.1–CNA
Mendix Forgot Password Appstore module (Mendix 7 compatible)All versions < V3.2.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert-portal.siemens.com/productcert/pdf/ssa-134279.pdf