CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
472 vulnerabilities reference this CWE, most recent first.
GHSA-M4W7-G56P-3VC4
Vulnerability from github – Published: 2023-05-24 21:30 – Updated: 2024-04-04 04:19A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
{
"affected": [],
"aliases": [
"CVE-2023-31459"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-24T20:15:10Z",
"severity": "HIGH"
},
"details": "A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.",
"id": "GHSA-m4w7-g56p-3vc4",
"modified": "2024-04-04T04:19:54Z",
"published": "2023-05-24T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31459"
},
{
"type": "WEB",
"url": "https://www.mitel.com/support/security-advisories"
},
{
"type": "WEB",
"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M5GX-365M-GFGX
Vulnerability from github – Published: 2025-12-19 21:30 – Updated: 2025-12-19 21:30LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.
{
"affected": [],
"aliases": [
"CVE-2023-53958"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-19T21:15:52Z",
"severity": "HIGH"
},
"details": "LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.",
"id": "GHSA-m5gx-365m-gfgx",
"modified": "2025-12-19T21:30:20Z",
"published": "2025-12-19T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53958"
},
{
"type": "WEB",
"url": "https://github.com/ltb-project/self-service-password"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51275"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/ldap-tool-box-self-service-password-account-takeover-via-http-host-header"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-M5WP-9JW2-R9VP
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.
{
"affected": [],
"aliases": [
"CVE-2020-15949"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-05T15:15:00Z",
"severity": "HIGH"
},
"details": "Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.",
"id": "GHSA-m5wp-9jw2-r9vp",
"modified": "2022-05-24T17:33:12Z",
"published": "2022-05-24T17:33:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15949"
},
{
"type": "WEB",
"url": "https://labs.bishopfox.com/advisories"
},
{
"type": "WEB",
"url": "https://labs.bishopfox.com/advisories/immuta-version-2.8.2"
},
{
"type": "WEB",
"url": "https://www.immuta.com"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M857-MPG8-9P23
Vulnerability from github – Published: 2022-05-14 03:02 – Updated: 2022-05-14 03:02Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.
{
"affected": [],
"aliases": [
"CVE-2018-1000501"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-26T16:29:00Z",
"severity": "CRITICAL"
},
"details": "Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tackover. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in v0.3.3.",
"id": "GHSA-m857-mpg8-9p23",
"modified": "2022-05-14T03:02:45Z",
"published": "2022-05-14T03:02:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000501"
},
{
"type": "WEB",
"url": "https://github.com/InstantUpdate/CMS/commit/5e70496b6b0c4cd554e62a709a248c1584533da6"
},
{
"type": "WEB",
"url": "http://my.instant-update.com/t/i-wanna-to-report-an-security-issue/659/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MGG5-84CV-FC3C
Vulnerability from github – Published: 2024-01-12 15:30 – Updated: 2025-10-22 00:32An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
{
"affected": [],
"aliases": [
"CVE-2023-7028"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-12T14:15:49Z",
"severity": "CRITICAL"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.",
"id": "GHSA-mgg5-84cv-fc3c",
"modified": "2025-10-22T00:32:58Z",
"published": "2024-01-12T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7028"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2293343"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/436084"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028"
},
{
"type": "WEB",
"url": "https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MGR7-VCH3-X89H
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-05-24 19:13Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.
{
"affected": [],
"aliases": [
"CVE-2021-36095"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-06T14:15:00Z",
"severity": "MODERATE"
},
"details": "Malicious attacker is able to find out valid user logins by using the \"lost password\" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.",
"id": "GHSA-mgr7-vch3-x89h",
"modified": "2022-05-24T19:13:03Z",
"published": "2022-05-24T19:13:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36095"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2021-18"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MJMW-3M65-4C84
Vulnerability from github – Published: 2025-02-11 15:32 – Updated: 2025-02-11 15:32Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.
{
"affected": [],
"aliases": [
"CVE-2025-1231"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-11T14:15:31Z",
"severity": "MODERATE"
},
"details": "Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.",
"id": "GHSA-mjmw-3m65-4c84",
"modified": "2025-02-11T15:32:24Z",
"published": "2025-02-11T15:32:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1231"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2025-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MMX4-RRQX-Q94X
Vulnerability from github – Published: 2022-05-13 01:11 – Updated: 2025-04-20 03:38register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm.
{
"affected": [],
"aliases": [
"CVE-2017-9543"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-12T06:29:00Z",
"severity": "HIGH"
},
"details": "register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm.",
"id": "GHSA-mmx4-rrqx-q94x",
"modified": "2025-04-20T03:38:48Z",
"published": "2022-05-13T01:11:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9543"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42154"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MP8R-JGRR-9J4X
Vulnerability from github – Published: 2022-05-14 01:32 – Updated: 2022-05-14 01:32OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2018-0696"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-02-13T18:29:00Z",
"severity": "HIGH"
},
"details": "OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.",
"id": "GHSA-mp8r-jgrr-9j4x",
"modified": "2022-05-14T01:32:41Z",
"published": "2022-05-14T01:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0696"
},
{
"type": "WEB",
"url": "https://www.cs.themistruct.com/report/wam20181012"
},
{
"type": "WEB",
"url": "https://www.osstech.co.jp/support/am2018-4-1-en"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN49995005/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MQJC-WG38-CGVF
Vulnerability from github – Published: 2025-12-05 00:31 – Updated: 2025-12-05 00:31The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.
{
"affected": [],
"aliases": [
"CVE-2025-53704"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-04T22:15:48Z",
"severity": "HIGH"
},
"details": "The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.",
"id": "GHSA-mqjc-wg38-cgvf",
"modified": "2025-12-05T00:31:05Z",
"published": "2025-12-05T00:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53704"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-338-02.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-338-02"
},
{
"type": "WEB",
"url": "https://www.maxhub.com/en/support"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.