CVE-2023-43902

CriticalCVSS 9.8

Published: 14/11/2023(UTC)Updated: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.86%

56th percentile - higher than 56% of all known CVEs

Summary

Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including administrators, via a crafted password reset token.

Risk Assessment

An attacker can take over administrator and user accounts, leading to full system and data compromise.

Recommendation

Update EMSigner to the latest version and apply the vendor's fix for access control in the password reset process.

Original NVD description (English source)

Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token.