CVE-2023-34357CWE-640

Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password

High · published September 7, 2023

CVSS v3.1
7.8
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has the line can thus use the URL again to change the password in order to take over the account.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00180 · 7.1th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2023-09-07T02:00Z
EPSS history
Timeline
  • 07 SEP 02:00Z
    Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password
    cvelistv5