CVE Daily

CVE-2015-8267

The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in Pass...

Critical CVSS 10.0

Overview

The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.

CWE: CWE-264 Published: 2015-12-24T00:59:00.107
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 10.0 (CRITICAL)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags