CVE-2023-34357 HIGH

CVE-2023-34357: Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password

Vendor Soar Cloud Ltd.
Product HR Portal
Weakness CWE-640 · Weak password recovery
Published September 7, 2023
Last update September 26, 2024
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Soar Cloud Ltd. HR Portal has a weak Password Recovery Mechanism for Forgotten Password. The reset password link sent out through e-mail, and the link will remain valid after the password has been reset and after the expected expiration date. An attacker with access to the browser history or has the line can thus use the URL again to change the password in order to take over the account.

Key dates

02Disclosure timeline

September 7, 2023 CVE published
September 26, 2024 Record updated