CVE-2023-34357

CVSS V2 None CVSS V3 None

Description

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has the line can thus use the URL again to change the password in order to take over the account.

Overview

CVE ID
CVE-2023-34357

Assigner
twcert

Vulnerability Status
PUBLISHED

Published Version
2023-09-07T02:00:15.946Z

Last Modified Date
2023-09-07T02:00:15.946Z

Weakness Enumerations

CWE	URL
CWE-640	http://cwe.mitre.org/data/definitions/640.html

References

Reference URL	Reference Tags
https://www.twcert.org.tw/tw/cp-132-7347-2653e-1.html

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-34357
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34357

History

Created	Old Value	New Value	Data Type	Notes
2024-06-25 20:47:16				Added to TrackCVE