{"containers": {"cna": {"affected": [{"product": "OpenCRX", "vendor": "CRIXP", "versions": [{"lessThanOrEqual": "4.30", "status": "affected", "version": "4.30", "versionType": "custom"}, {"lessThanOrEqual": "5.0-20200717", "status": "affected", "version": "5.0-20200717", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "This issue was discovered and reported by Trevor Christiansen of Rapid7 in accordance with Rapid7's standard vulnerability disclosure policy."}], "datePublic": "2020-11-24T00:00:00", "descriptions": [{"lang": "en", "value": "CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-620", "description": "CWE-620 Unverified Password Change", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-11-24T16:35:14", "orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://blog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change/"}], "solutions": [{"lang": "en", "value": "Users should update to 5.0-20200904 or later. If an update is infeasible, users should disable the RequestPasswordReset.jsp wizard."}], "source": {"discovery": "USER"}, "title": "CRIXP OpenCRX Unverified Password Change", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@rapid7.com", "DATE_PUBLIC": "2020-11-24T15:00:00.000Z", "ID": "CVE-2020-7378", "STATE": "PUBLIC", "TITLE": "CRIXP OpenCRX Unverified Password Change"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "OpenCRX", "version": {"version_data": [{"version_affected": "<=", "version_name": "4.30", "version_value": "4.30"}, {"version_affected": "<=", "version_name": "5.0-20200717", "version_value": "5.0-20200717"}]}}]}, "vendor_name": "CRIXP"}]}}, "credit": [{"lang": "eng", "value": "This issue was discovered and reported by Trevor Christiansen of Rapid7 in accordance with Rapid7's standard vulnerability disclosure policy."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-620 Unverified Password Change"}]}]}, "references": {"reference_data": [{"name": "https://blog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change/", "refsource": "MISC", "url": "https://blog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change/"}]}, "solution": [{"lang": "en", "value": "Users should update to 5.0-20200904 or later. If an update is infeasible, users should disable the RequestPasswordReset.jsp wizard."}], "source": {"discovery": "USER"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:25:49.033Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change/"}]}]}, "cveMetadata": {"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "assignerShortName": "rapid7", "cveId": "CVE-2020-7378", "datePublished": "2020-11-24T16:35:15.035583Z", "dateReserved": "2020-01-21T00:00:00", "dateUpdated": "2024-09-16T20:37:06.713Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opencrx:opencrx:*:*:*:*:*:*:*:*", "matchCriteriaId": "8282601F-778E-4BCE-A249-9AF5632CB571", "versionEndIncluding": "4.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:opencrx:opencrx:5.0:20200714:*:*:*:*:*:*", "matchCriteriaId": "A0F57F4C-1DDA-4975-83BF-FCE95EF8391F", "vulnerable": true}, {"criteria": "cpe:2.3:a:opencrx:opencrx:5.0:20200715:*:*:*:*:*:*", "matchCriteriaId": "A1404512-2851-4B11-82A4-6F6027E71E4D", "vulnerable": true}, {"criteria": "cpe:2.3:a:opencrx:opencrx:5.0:20200717:*:*:*:*:*:*", "matchCriteriaId": "372C678B-244F-498E-8E1B-FA49BC94B521", "vulnerable": true}, {"criteria": "cpe:2.3:a:opencrx:opencrx:5.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B0DFA3FE-F0A3-4674-9E2D-8049CBDE3CB4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020."}, {"lang": "es", "value": "CRIXP OpenCRX versiones 4.30 y 5.0-20200717 y anteriores sufre de una vulnerabilidad de cambio de contrase\u00f1a no verificada.&#xa0;Un atacante que es capaz de conectarse a la instancia de OpenCRX afectada puede cambiar la contrase\u00f1a de cualquier usuario, incluyendo admin-Standard, para cualquier valor elegido.&#xa0;Este problema se resolvi\u00f3 en la versi\u00f3n 5.0-20200904, publicada el 4 de septiembre de 2020"}], "id": "CVE-2020-7378", "lastModified": "2024-11-21T05:37:08.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "cve@rapid7.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-24T17:15:11.270", "references": [{"source": "cve@rapid7.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.rapid7.com/2020/11/24/cve-2020-7378-opencrx-unverified-password-change/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-620"}], "source": "cve@rapid7.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}