Default credentials

2018-06-0511:29:00

PRIOn knowledge base

www.prio-n.com

9.2 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.8%

JSON

The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach.

CPENameOperatorVersion
yzmcmsge3.2
yzmcmsle3.7

CPE	Name	Operator	Version
	yzmcms	ge	3.2
	yzmcms	le	3.7

References

github.com/littleheary/-YzmCMS-User-Traversal-Vulnerability/blob/master/README.md