Vulnerability · Published Sep 4, 2023 · Assigned by INCIBE
CVE-2023-3222Vulnerability in the password recovery mechanism of Roundcube Password Recovery Plugin
High 7.5
In plain English
A high-severity security flaw in Password Recovery Plugin from AlfnRU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AlfnRU | Password Recovery Plugin | 1.2 |
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N