CVE-2022-29174: countly server

csirt@kutim:~/threat-intel/cve/CVE-2022-29174

CVSS 8.1 · High EPSS 1,5%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada countly server. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.

Rincian

Terbit di NVD: 17 Mei 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-640: Weak Password Recovery Mechanism for Forgotten Password
EPSS (30 hari): 1,5% peluang dieksploitasi; lebih tinggi dari 73,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
count	countly server	Semua versi sebelum 21.11.4
count	countly server	Versi 22.03 hingga sebelum 22.03.7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999 patch · advisory pihak ketiga
https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v patch · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.