PT-2022-19977 · Unknown · Dradis Professional Edition

Published 2022-06-24 · Updated 2022-07-01 · CVE-2022-30028

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dradis Professional Edition versions prior to 4.3.0

Description The issue allows attackers to change an account password via reusing a password reset token.

Recommendations For versions prior to 4.3.0, update to version 4.3.0 or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2022-30028

Affected Products

Dradis Professional Edition

References · 4

• https://dradisframework.com/ce/security_reports.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30028 · Security Note
• https://t.me/cibsecurity/45117 · Telegram Post