CVE-2023-2807 - Authentication bypass in password reset process · CoreCVE

Back Back to CVE browser

CRITICAL

Authentication bypass in password reset process

Published Jun 13, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.62%

Description

Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication. This issue affects PandoraFMS v771 and prior versions on all platforms.

Affected products

Vendor Artica PFMS Product Pandora FMS Default
unaffected
- Version
  v0
  Status
  affected
  Constraints
  <=v771

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
v0	affected	<=v771

Remediation

Vendor solution

Fixed in v772

Weaknesses (1)

CWE-290

Authentication Bypass by Spoofing

References (1)

https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCIBE

Published Jun 13, 2023

Updated Jan 3, 2025

Reserved May 19, 2023

Link CVE-2023-2807

CISA Vulnrichment

Updated Jan 3, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2023-2807

Severity n/a

Public date n/a

Links CVE-2023-2807