CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-43623
https://notcve.org/view.php?id=CVE-2023-43623
10 Oct 2023 — A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.3), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.3), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.4.0). Applications using the affected module are vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid ... • https://cert-portal.siemens.com/productcert/pdf/ssa-295483.pdf • CWE-203: Observable Discrepancy •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-27464
https://notcve.org/view.php?id=CVE-2023-27464
11 Apr 2023 — A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.1.1). The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information. • https://cert-portal.siemens.com/productcert/pdf/ssa-699404.pdf • CWE-203: Observable Discrepancy CWE-204: Observable Response Discrepancy •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-26314
https://notcve.org/view.php?id=CVE-2022-26314
08 Mar 2022 — A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations. Se ha identificado una vulnerabilidad en el módulo Mendix Forgot Password Appstore (Todas las versiones posteriores a V3.3.0 incluyéndola, anteri... • https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26313
https://notcve.org/view.php?id=CVE-2022-26313
08 Mar 2022 — A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts. Se ha identificado una vulnerabilidad en el módulo Mendix Forgot Password Appstore (Todas las versiones posteriores a V3.3.0 incluyéndola, anteriores a V3.5.1). En determinadas configuraciones del producto afectado, un actor de amenaza podría usar el flujo de registro pa... • https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25672
https://notcve.org/view.php?id=CVE-2021-25672
15 Mar 2021 — A vulnerability has been identified in Mendix Forgot Password Appstore module (All Versions < V3.2.1). The Forgot Password Marketplace module does not properly control access. An attacker could take over accounts. Se ha identificado una vulnerabilidad en el módulo Mendix Forgot Password Appstore (Todas las versiones anteriores a V3.2.1). El módulo de Marketplace Forgot Password no controla el acceso apropiadamente. • https://cert-portal.siemens.com/productcert/pdf/ssa-917115.pdf • CWE-284: Improper Access Control •