Mangati NovoSGA CVE-2025-11322
LOWSeverity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Weak password requirements in Mangati NovoSGA up to version 2.2.12 allow remote attackers to bypass password policy validation during user account creation via manipulation of the Senha/Confirmação da senha (password/password confirmation) parameters on the /novosga.users/new endpoint. The vulnerability is difficult to exploit (CVSS AC:H) and offers only low confidentiality impact, but public exploit code is available and enables brute-force attacks against weak user credentials. EPSS score of 0.04% (percentile 12%) indicates limited real-world exploitation likelihood despite CVE publication.
Technical ContextAI
Mangati NovoSGA is a Brazilian queue management system. The vulnerability resides in the user creation functionality (component User Creation Page) at the /novosga.users/new endpoint. The flaw is classified as CWE-521 (Weak Password Requirements), indicating the application fails to enforce adequate password complexity or length validation. The manipulation of the Senha (password) and Confirmação da senha (password confirmation) arguments suggests the application either accepts empty strings, very short passwords, or lacks server-side validation of password strength criteria. Remote attackers can interact with the user creation interface to create accounts with weak passwords, which then become targets for dictionary or brute-force attacks. This is a web application logic flaw rather than a network protocol or cryptographic vulnerability.
Affected ProductsAI
Mangati NovoSGA versions up to and including 2.2.12 are confirmed affected. The user creation page component is the affected functionality. No specific CPE string was provided in the source data, but CVE-2025-11322 is tied to Mangati NovoSGA as referenced in vuldb.com (CVE identifier 327203) and the GitHub disclosure repository (marcelomulder/CVE). Users of NovoSGA versions prior to 2.2.12 should verify their specific version against the vendor's release notes.
RemediationAI
Upgrade Mangati NovoSGA to a patched version beyond 2.2.12 if available from the vendor. Given the lack of vendor response documented in the CVE description, verify directly with Mangati (or the current maintainer) whether a patch exists. If no patch is forthcoming, implement compensating controls: (1) enforce password policy at the LDAP/directory level (if NovoSGA integrates with Active Directory or LDAP) to override weak application-level acceptance, (2) implement a Web Application Firewall (WAF) rule to reject user creation requests with passwords shorter than 12 characters or lacking complexity markers (capitals, numbers, symbols), and (3) monitor and disable accounts with weak passwords post-hoc using NovoSGA's administrative interface or a scheduled policy audit script. Note that WAF-level controls may impact legitimate administrative workflows if weak temporary passwords are intentionally issued. The highest-confidence fix remains patching if available; otherwise, directory-level password policy enforcement is the most robust workaround because it applies uniformly across all applications using that directory.
More in Brute Force
View allRuggedCom Rugged Operating System (ROS) before 3.3 has a factory account with a password derived from the MAC Address fi
An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity
Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits o
Critical authentication bypass vulnerability in OpenC3 COSMOS v6.0.0 caused by weak password requirements that enable br
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immedia
I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creatio
Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0. Rated critical severity (CVSS 9.8), this
Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20. Rated critical severity (CVSS 9.8)
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12. Rated critical severity (CVSS 9.8), t
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. R
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Rated critical severity (CVSS 9.8), th
Weak Password Requirements in GitHub repository ikus060/minarca prior to 4.2.2. Rated critical severity (CVSS 9.8), this
Same weakness CWE-521 – Weak Password Requirements
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today