Soar Cloud · Soar Cloud Ltd. Hr Portal · CVE-2023-34357
**Name of the Vulnerable Software and Affected Versions**
Soar Cloud Ltd. HR Portal (affected versions not specified)
**Description**
The issue concerns a weak Password Recovery Mechanism for Forgotten Password in the Soar Cloud Ltd. HR Portal. The reset password link sent out through e-mail remains valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or the link can use the URL again to change the password, potentially taking over the account.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.