Lucene search

MitreCVE-2022-30935

HistorySep 28, 2022 - 11:15 a.m.

CVE-2022-30935

2022-09-2811:15:09

CWE-330

mitre

web.nvd.nist.gov

cve-2022-30935

authorization bypass

b2evolution

security vulnerability

password reset

nvd

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

58.7%

JSON

An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This allows the attacker to get valid sessions for arbitrary users, and optionally reset their password. Tested and confirmed in a default installation of version 7.2.3. Earlier versions are affected, possibly earlier major versions as well.

Affected configurations

Nvd

Node

b2evolutionb2evolutionRange<7.2.5

VendorProductVersionCPE
b2evolutionb2evolution*cpe:2.3:a:b2evolution:b2evolution:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
b2evolution	b2evolution	*	cpe:2.3:a:b2evolution:b2evolution::::::::

References

b2evolution.net/downloads/7-2-5-stable

github.com/b2evolution/b2evolution/blob/master/inc/_core/_misc.funcs.php#L5955

github.com/b2evolution/b2evolution/issues/114

Social References

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

58.7%

JSON

Related for CVE-2022-30935