PT-2023-12776 · Rocket · Rocket Trufusion Portal

Publicado 2023-01-12 · Atualizado 2025-04-08 · CVE-2022-25027

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Portal version 7.9.2.1

Description The issue concerns the Forgotten Password functionality, which allows remote attackers to bypass authentication. This is achieved by validating the user's session token when the "Password forgotten?" button is clicked, enabling access to restricted pages.

Recommendations For Rocket TRUfusion Portal version 7.9.2.1, consider disabling the Forgotten Password functionality as a temporary workaround until a patch is available. Restrict access to restricted pages to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-640

CWE-287

Identificadores relacionados

CVE-2022-25027

Produtos afetados

Rocket Trufusion Portal

Referências · 5

• https://t.me/cvenotify/118230 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-25027 · Aviso do Fabricante
• https://labs.nettitude.com/blog/cve-2022-25026-cve-2022-25027-vulnerabilities-in-rocket-trufusion-enterprise · Correção
• https://t.me/cvenotify/118231 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-25027 · Nota de Segurança