Lucene search

TwcertCVE-2023-34357

HistorySep 07, 2023 - 3:15 a.m.

CVE-2023-34357

2023-09-0703:15:08

CWE-640

twcert

web.nvd.nist.gov

soar cloud ltd.

hr portal

weak password recovery

forgotten password

cve-2023-34357

information security

vulnerability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has the line can thus use the URL again to change the password in order to take over the account.

Affected configurations

Nvd

Node

scshrhr_portalMatch7.3.2023.0510

scshrhr_portalMatch7.3.2023.0705

VendorProductVersionCPE
scshrhr_portal7.3.2023.0510cpe:2.3:a:scshr:hr_portal:7.3.2023.0510:*:*:*:*:*:*:*
scshrhr_portal7.3.2023.0705cpe:2.3:a:scshr:hr_portal:7.3.2023.0705:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
scshr	hr_portal	7.3.2023.0510	cpe:2.3:a:scshr:hr_portal:7.3.2023.0510:::::::*
scshr	hr_portal	7.3.2023.0705	cpe:2.3:a:scshr:hr_portal:7.3.2023.0705:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "HR Portal",
    "vendor": "Soar Cloud Ltd. ",
    "versions": [
      {
        "status": "affected",
        "version": "7.3.2023.0510"
      },
      {
        "status": "affected",
        "version": "7.3.2023.0705"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7347-2653e-1.html

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-34357