CVEvulnerability
CVE-2021-28293
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-06-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-640
Description
Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password reset functionality, and thus an unauthenticated attacker can set an arbitrary password for any user.
Affected configurations
• seceon aisiem (< 6.3.2)
Related
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness
References
- https://0xdb9.in/2021/06/07/cve-2021-28293.html Exploit, Third Party Advisory
- https://www.seceon.com/advanced-siem-aisiem Product, Vendor Advisory
- https://0xdb9.in/2021/06/07/cve-2021-28293.html Exploit, Third Party Advisory
- https://www.seceon.com/advanced-siem-aisiem Product, Vendor Advisory