CVE-2025-29995CWE-640

Account Takeover Vulnerability in CAP back office application

High · published March 13, 2025

CVSS v4.0
8.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:N
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2025-03-13T11:16Z
EPSS history
Timeline
  • 13 MAR 11:16Z
    Account Takeover Vulnerability in CAP back office application
    cvelistv5