CVE Catalog
CVE-2021-29023
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk0.84%
54th percentile - higher than 54% of all known CVEs
Summary
InvoicePlane 1.5.11 lacks rate-limiting for password reset and uses a weak, predictable token generation mechanism.
Risk Assessment
An attacker can repeatedly attempt password resets and predict the token, enabling account takeover of administrators or other users.
Recommendation
Update InvoicePlane to a version that implements request rate-limiting and secure password reset token generation.
Original NVD description (English source)
InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predictable.