CVE-2022-25027

{"id": "CVE-2022-25027", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-01-12T23:15:09.910", "references": [{"url": "https://labs.nettitude.com/blog/cve-2022-25026-cve-2022-25027-vulnerabilities-in-rocket-trufusion-enterprise/", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the \"Password forgotten?\" button is clicked."}, {"lang": "es", "value": "La funcionalidad de contrase\u00f1a olvidada de Rocket TRUfusion Portal v7.9.2.1 permite a atacantes remotos evitar la autenticaci\u00f3n y acceder a p\u00e1ginas restringidas validando el token de sesi\u00f3n del usuario cuando se hace clic en el boton \"\u00bfOlvid\u00f3 su contrase\u00f1a?\"."}], "lastModified": "2023-01-23T16:50:56.500", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rocketsoftware:trufusion_enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A43DC94-7EB9-4F3F-86AE-60FB49140F4F", "versionEndExcluding": "7.9.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}