CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Password Brute Forcing.This issue affects Real Estate Manager: from n/a through <= 7.3.
Explanation of Vulnerability in Simple Terms
Real Estate Manager versions 7.3 and earlier contain a weakness in password reset token generation that allows attackers to predict or brute-force password reset tokens without authentication. An attacker can use this to reset user passwords and gain unauthorized access to accounts. No user interaction is required. The vulnerability affects the integrity of user accounts but not data confidentiality or site availability.
What an attacker can do
Reset other users' passwords and take over their accounts without knowing their current password.
Potential impact on your site
User accounts can be compromised. Attackers may access or modify real estate listings, client data, and site settings.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
