CVE-2023-35134
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Weintek Weincloud version 0.13.6 could allow an attacker to reset a password using the corresponding account’s JWT token.
Risk Assessment
The ability to reset a password by an unauthorized person poses a serious risk to the security of user accounts and the data stored in the system.
Recommendation
It is recommended to update Weintek Weincloud to the latest version to mitigate this vulnerability and implement additional security measures for managing JWT tokens.
Other vulnerabilities in Weintek Weincloud v0.13.6
See all- CVE-2023-37362High
Weintek Weincloud version 0.13.6 may allow an attacker to abuse the registration functionality to log in with testing credentials to the official website.
- CVE-2023-34429High
Weintek Weincloud version 0.13.6 could allow an attacker to cause a denial-of-service condition by sending a forged JWT token.
Original NVD description (English source)
Weintek Weincloud v0.13.6 could allow an attacker to reset a password with the corresponding account’s JWT token only.