CVE-2022-29174 - Vulnerability Details - OpenCVE

ReportizFlow

countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Count	Countly Server

Configuration 1 [-]

OR	cpe:2.3:a:count:countly_server::::::::
	cpe:2.3:a:count:countly_server::::::::

No data.

References

Link	Providers
https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999
https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-05-17T20:45:10

Updated: 2024-08-03T06:17:53.998Z

Reserved: 2022-04-13T00:00:00

Link: CVE-2022-29174

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-05-17T21:15:08.380

Modified: 2024-11-21T06:58:38.540

Link: CVE-2022-29174

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "countly-server", "vendor": "Countly", "versions": [{"status": "affected", "version": "< 21.11.4"}, {"status": "affected", "version": ">= 22.0.0, < 22.03.7"}]}], "descriptions": [{"lang": "en", "value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-640", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-17T20:45:10", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"}], "source": {"advisory": "GHSA-98vh-wqw5-p23v", "discovery": "UNKNOWN"}, "title": "Predictable password reset token may lead to account takeover in countly-server", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2022-29174", "STATE": "PUBLIC", "TITLE": "Predictable password reset token may lead to account takeover in countly-server"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "countly-server", "version": {"version_data": [{"version_value": "< 21.11.4"}, {"version_value": ">= 22.0.0, < 22.03.7"}]}}]}, "vendor_name": "Countly"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v", "refsource": "CONFIRM", "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"}, {"name": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999", "refsource": "MISC", "url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"}]}, "source": {"advisory": "GHSA-98vh-wqw5-p23v", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:17:53.998Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-29174", "datePublished": "2022-05-17T20:45:10", "dateReserved": "2022-04-13T00:00:00", "dateUpdated": "2024-08-03T06:17:53.998Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:count:countly_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "2827D174-3849-42BE-8BCB-3B99A4B067EB", "versionEndExcluding": "21.11.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:count:countly_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "1694F16A-7DBE-40D5-8C91-BA16A482B04D", "versionEndExcluding": "22.03.7", "versionStartIncluding": "22.03", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface."}, {"lang": "es", "value": "countly-server es la parte del lado del servidor de Countly, una soluci\u00f3n de an\u00e1lisis de productos. En versiones anteriores a 22.03.7 y 21.11.4, un actor malicioso que conoce la direcci\u00f3n de correo electr\u00f3nico/nombre de usuario de una cuenta y el nombre completo especificado en la base de datos es capaz de adivinar el token de restablecimiento de la contrase\u00f1a. El actor puede usar esta informaci\u00f3n para restablecer la contrase\u00f1a y hacerse con la cuenta. El problema ha sido parcheado en Countly Server versi\u00f3n 22.03.7, para los servidores usando la nueva interfaz de usuario y en versi\u00f3n 21.11.4, para servidores usando la antigua interfaz de usuario"}], "id": "CVE-2022-29174", "lastModified": "2024-11-21T06:58:38.540", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-05-17T21:15:08.380", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"}, {"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "[email protected]", "type": "Secondary"}]}