Description

A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations.

Related CPE's

a

mendix

forgot_password

2

References

https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf

MitigationPatchVendor Advisory

Weaknesses

[email protected]

Primary
CWE-307

[email protected]

Secondary
CWE-307

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2022-03-08T12:15:11.823

3 years ago

Last modified

2022-03-11T19:04:08.777

3 years ago