CVE-2022-44938 - Vulnerability Details - OpenCVE

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact total

Vendors	Products
Seeddms	Seeddms

Configuration 1 [-]

OR	cpe:2.3:a:seeddms:seeddms:5.1.7:::::::*
	cpe:2.3:a:seeddms:seeddms:6.0.20:::::::*

No data.

References

Link	Providers
https://pwnit.io/2022/11/23/weak-password-reset-token-leads-to-account-takeover-in-seeddms/

History

Wed, 23 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-330
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-08T00:00:00.000Z

Updated: 2025-04-23T15:09:15.699Z

Reserved: 2022-11-07T00:00:00.000Z

Link: CVE-2022-44938

Vulnrichment

Updated: 2024-08-03T14:01:31.410Z

NVD

Status : Modified

Published: 2022-12-08T20:15:10.417

Modified: 2025-04-23T16:15:27.323

Link: CVE-2022-44938

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:seeddms:seeddms:5.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "8830F322-6D90-4F38-8F31-8E961ABB9A4D", "vulnerable": true}, {"criteria": "cpe:2.3:a:seeddms:seeddms:6.0.20:*:*:*:*:*:*:*", "matchCriteriaId": "79EF4AFF-088A-4B97-BAFE-789FEF509C2E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack."}, {"lang": "es", "value": "La generaci\u00f3n d\u00e9bil de tokens de reinicio en SeedDMS v6.0.20 y v5.1.7 permite a los atacantes ejecutar una apropiaci\u00f3n completa de la cuenta mediante un ataque de fuerza bruta."}], "id": "CVE-2022-44938", "lastModified": "2025-04-23T16:15:27.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-08T20:15:10.417", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://pwnit.io/2022/11/23/weak-password-reset-token-leads-to-account-takeover-in-seeddms/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://pwnit.io/2022/11/23/weak-password-reset-token-leads-to-account-takeover-in-seeddms/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-330"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}