CVE-2020-14016

Katalog CVE

CVSS 5.3 · Medium EPSS 1,6%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada naviwebs navigate cms. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to reset their passwords by using either their username or the email address associated with their account. However, the feature returns a not_found message when the provided username or email address does not match a user in the system. This can be used to enumerate users.

Rincian

Terbit di NVD

24 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.sean-wright.com/navigate-cms/ exploit · advisory pihak ketiga
• https://cwe.mitre.org/data/definitions/204.html