Vulnerability · Published Nov 24, 2020 · Assigned by rapid7
CVE-2020-7378CRIXP OpenCRX Unverified Password Change
Critical 9.1
In plain English
A critical-severity security flaw in OpenCRX from CRIXP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020.
Affected products (as reported)
Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N