CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-43623
https://notcve.org/view.php?id=CVE-2023-43623
A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.3), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.3), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.4.0). Applications using the affected module are vulnerable to user enumeration due to distinguishable responses. This could allow an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users. Se ha identificado una vulnerabilidad en: Mendix Forgot Password (compatible con Mendix 10) (todas las versiones < V5.4.0), Mendix Forgot Password (compatible con Mendix 7) (todas las versiones < V3.7.3), Mendix Forgot Password (compatible con Mendix 8) (Todas versiones < V4.1.3), Mendix Forgot Password (compatible con Mendix 9) (Todas las versiones < V5.4.0). Las aplicaciones que utilizan el módulo afectado son vulnerables a la enumeración de usuarios debido a respuestas distinguibles. Esto podría permitir que un atacante remoto no autenticado determine si un usuario es válido o no, permitiendo un ataque de fuerza bruta con usuarios válidos. • https://cert-portal.siemens.com/productcert/pdf/ssa-295483.pdf • CWE-203: Observable Discrepancy •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2023-27464
https://notcve.org/view.php?id=CVE-2023-27464
A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All versions < V4.1.1), Mendix Forgot Password (Mendix 9 compatible) (All versions < V5.1.1). The affected versions of the module contain an observable response discrepancy issue that could allow an attacker to retrieve sensitive information. • https://cert-portal.siemens.com/productcert/pdf/ssa-699404.pdf • CWE-203: Observable Discrepancy CWE-204: Observable Response Discrepancy •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-26314
https://notcve.org/view.php?id=CVE-2022-26314
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix 7 compatible) (All versions < V3.2.2). Initial passwords are generated in an insecure manner. This could allow an unauthenticated remote attacker to efficiently brute force passwords in specific situations. Se ha identificado una vulnerabilidad en el módulo Mendix Forgot Password Appstore (Todas las versiones posteriores a V3.3.0 incluyéndola, anteriores a V3.5.1), módulo Mendix Forgot Password Appstore (compatible con Mendix 7) (Todas las versiones anteriores a V3.2.2). Las contraseñas iniciales son generadas de forma no segura. • https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26313
https://notcve.org/view.php?id=CVE-2022-26313
A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected product, a threat actor could use the sign up flow to hijack arbitrary user accounts. Se ha identificado una vulnerabilidad en el módulo Mendix Forgot Password Appstore (Todas las versiones posteriores a V3.3.0 incluyéndola, anteriores a V3.5.1). En determinadas configuraciones del producto afectado, un actor de amenaza podría usar el flujo de registro para secuestrar cuentas de usuario arbitrarias • https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-25672
https://notcve.org/view.php?id=CVE-2021-25672
A vulnerability has been identified in Mendix Forgot Password Appstore module (All Versions < V3.2.1). The Forgot Password Marketplace module does not properly control access. An attacker could take over accounts. Se ha identificado una vulnerabilidad en el módulo Mendix Forgot Password Appstore (Todas las versiones anteriores a V3.2.1). El módulo de Marketplace Forgot Password no controla el acceso apropiadamente. • https://cert-portal.siemens.com/productcert/pdf/ssa-917115.pdf • CWE-284: Improper Access Control •