PT-2022-15899 · Priority · Priority

Published 2022-07-06 · Updated 2022-07-14 · CVE-2022-23172

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description An attacker can access the "Forgot my password" button to verify which users are in the system and which are not. By entering a valid user, the system issues a message that a password reset email has been sent to the user, thus allowing the attacker to determine the existence of specific users within the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2022-23172

Affected Products

Priority

References · 5

• https://osv.dev/vulnerability/CVE-2022-23172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23172 · Security Note
• https://t.me/cvenotify/32670 · Telegram Post
• https://t.me/cibsecurity/45662 · Telegram Post
• https://gov.il/en/departments/faq/cve_advisories · Note