CVE-2021-25961

High

In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is…

Mend·CWE-640·Published 2021-09-29

CVSS

8.0

EPSS

0.01

KEV

Exploits

cve.orgen

268 chars

In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id.

NVDen

268 chars

NVDes

346 chars

En la aplicación "SuiteCRM", versiones v7.1.7 hasta v7.10.31 y versiones v7.11-beta hasta v7.11.20, falla al no comprobar apropiadamente los enlaces de restablecimiento de la contraseña asociados a un identificador de usuario eliminado, lo que permite una toma de la cuenta de cualquier usuario recién creado con el mismo identificador de usuario

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	6.0	6.8	6.4	AV:N/AC:M/Au:S/C:P/I:P/A:P
3.1	Primary	cve.org	8.0	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
3.1	Primary	NVD	8.0	2.1	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	8.0	—	—	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
3.1	Secondary	NVD	8.0	2.1	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H