CVE-2021-28293 - Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature

Back Back to CVE browser

CRITICAL

Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature

Published Jun 8, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 1.61%

Description

Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password reset functionality, and thus an unauthenticated attacker can set an arbitrary password for any user.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-640

References (3)

https://0xdb9.in/2021/06/07/cve-2021-28293.html
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14982
Advisory
https://www.seceon.com/advanced-siem-aisiem
x_refsource_MISCProductVendor Advisory

Link	Providers	Tags
https://0xdb9.in/2021/06/07/cve-2021-28293.html		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-14982		Advisory
https://www.seceon.com/advanced-siem-aisiem		x_refsource_MISCProductVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 8, 2021

Updated Aug 3, 2024

Reserved Mar 12, 2021

Link CVE-2021-28293

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-28293

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jun 8, 2021

Updated Aug 3, 2024

Link EUVD-2021-14982

GitHub

No data