Lucene search

MitreCVE-2024-38287

HistoryJul 25, 2024 - 8:15 p.m.

CVE-2024-38287

2024-07-2520:15:04

CWE-640

mitre

web.nvd.nist.gov

cve

password-reset

r-hub turbomeeting

remote attackers

administrator's password

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.001

Percentile

39.6%

JSON

The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator’s password to a random insecure 8-digit value.

Affected configurations

Nvd

Node

rhubcomturbomeetingRange<8.0

References

github.com/google/security-research/security/advisories/GHSA-c84v-4pjw-4mh2

www.rhubcom.com/v5/manuals.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

Low

EPSS

0.001

Percentile

39.6%

JSON

Related for CVE-2024-38287