CVE-2024-45670CWE-640

IBM Security SOAR weak password recovery mechanism

Medium · published November 14, 2024

CVSS v3.1
5.6
EPSS
0%
Percentile
24.7
In the wild
Unconfirmed
What it is

IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.7th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2024-11-14T11:50Z
EPSS history
Timeline
  • 14 NOV 11:50Z
    IBM Security SOAR weak password recovery mechanism
    cvelistv5