CVE-2022-25027

High

The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access…

mitre·CWE-640·Published 2023-01-12

CVSS

7.5

EPSS

0.01

KEV

Exploits

cve.orgen

238 chars

The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.

NVDen

238 chars

NVDes

259 chars

La funcionalidad de contraseña olvidada de Rocket TRUfusion Portal v7.9.2.1 permite a atacantes remotos evitar la autenticación y acceder a páginas restringidas validando el token de sesión del usuario cuando se hace clic en el boton "¿Olvidó su contraseña?".

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Primary	cve.org	7.5	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N