Priority
CVE-2022-23172
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not.
AnalysisAI
An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-640. An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would issue a message that a password reset email had been sent to user. This way you can verify which users are in the system and which are not. Affected products include: Priority-Software Priority.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Authentication bypass in the Priority Portal Generator add-on for Priority ERP (developed by Soft Solutions) lets remote
Priority Web version 19.1.0.68, parameter manipulation on an unspecified end-point may allow authentication bypass. Rate
Priority Windows may allow Command Execution via SQL Injection using an unspecified method. Rated critical severity (CVS
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauth
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solu
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allo
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Soluti
Unauthenticated authentication bypass in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows
Unauthenticated remote information disclosure in the Portal Generator Addon for Priority ERP (developed by Soft Solution
Unauthenticated remote access control bypass in the Portal Generator Addon for Priority ERP (developed by Soft Solutions
Priority - CWE-552: Files or Directories Accessible to External Parties. Rated high severity (CVSS 7.5), this vulnerabil
Priority - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Rated high severity (CVSS 7.5), this vul
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today