PT-2022-18255 · Pearweb · Pearweb

Ashnazg + 1 · Published 2022-04-15 · Updated 2022-04-22 · CVE-2022-27157

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pearweb versions prior to 1.32

Description The issue is related to a weak password recovery mechanism. It is specifically exploitable via the include/users/passwordmanage.php endpoint.

Recommendations For versions prior to 1.32, update to version 1.32 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2022-27157

Affected Products

Pearweb

References · 3

• https://github.com/pear/pearweb/commit/6447c174a6b4bd76d28ecca8543cbd24bf394f99#diff-204452a70c5b0b0084097fcff6aee77c2c38cb77a41c4b2dd0065fda37a7489c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-27157 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27157 · Vendor Advisory