CVE-2021-27654CWE-640

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks

High · published January 28, 2022

CVSS v3.0
8.8
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00603 · 48.1th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2022-01-28T19:09Z
EPSS history
Timeline
  • 28 JAN 19:09Z
    Forgotten password reset functionality for local accounts can be used to bypass local authentication checks
    cvelistv5