CVE-2022-23172

An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.gov.il/en/departments/faq/cve_advisories	Third Party Advisory
https://www.gov.il/en/departments/faq/cve_advisories	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:priority-software:priority:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:48

Type	Values Removed	Values Added
References	~~() https://www.gov.il/en/departments/faq/cve_advisories - Third Party Advisory~~	() https://www.gov.il/en/departments/faq/cve_advisories - Third Party Advisory
CVSS	v2 : ~~4.0~~ v3 : ~~4.3~~	v2 : 4.0 v3 : 5.5

14 Jul 2022, 17:56

Type	Values Removed	Values Added
References	~~(MISC) https://www.gov.il/en/departments/faq/cve_advisories -~~	(MISC) https://www.gov.il/en/departments/faq/cve_advisories - Third Party Advisory
CPE		cpe:2.3:a:priority-software:priority::::::::
CWE		CWE-640
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 4.0 v3 : 4.3

06 Jul 2022, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-07-06 14:15

Updated : 2024-11-21 06:48

NVD link : CVE-2022-23172

Mitre link : CVE-2022-23172

CVE.ORG link : CVE-2022-23172

JSON object : View

Products Affected

priority-software

priority

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2022-23172", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@cyber.gov.il", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-07-06T14:15:18.267", "references": [{"url": "https://www.gov.il/en/departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "cna@cyber.gov.il"}, {"url": "https://www.gov.il/en/departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "An attacker can access to \"Forgot my password\" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not."}, {"lang": "es", "value": "Un atacante puede acceder al bot\u00f3n \"Forgot my password\", tan pronto como ponga que el usuario es v\u00e1lido en el sistema, el sistema emitir\u00eda un mensaje de que un correo de restablecimiento de contrase\u00f1a ha sido enviado al usuario. De esta manera puede verificarse qu\u00e9 usuarios est\u00e1n en el sistema y cu\u00e1les no"}], "lastModified": "2024-11-21T06:48:07.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:priority-software:priority:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D20A9F84-8F5F-4164-85B4-7FE9F1C4C4D7", "versionEndExcluding": "22.0"}], "operator": "OR"}]}], "sourceIdentifier": "cna@cyber.gov.il"}