CVE-2024-50356

NONE Year: 2024
Weakness Type
CWE-640
View all →

Vulnerability Description

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). The password could be reset by anyone who have access to the mail inbox circumventing the 2FA. Even though they wouldn't be able to login by bypassing the 2FA. Only users who have enabled 2FA are affected. Commit ba0007c28ac814260f836849bc07d29beea7deb6 patches this bug.

Related Vulnerabilities

CVE-2012-5618

CRITICAL
CVSS:9.8(Critical)

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.

CWE-6402012

CVE-2012-5686

CRITICAL
CVSS:9.8(Critical)

ZPanel 10.0.1 has insufficient entropy for its password reset process.

CWE-6402012

CVE-2015-4689

CRITICAL
CVSS:9.8(Critical)

Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."

CWE-6402015

CVE-2015-5172

CRITICAL
CVSS:9.8(Critical)

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire p...

CWE-6402015

CVE-2017-17097

CRITICAL
CVSS:9.8(Critical)

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-...

CWE-6402017

CVE-2017-2766

CRITICAL
CVSS:9.8(Critical)

EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified pass...

CWE-6402017