CVE-2020-23359

CRITICAL

WeBid 1.2.2 - Incorrect Password Comparison in Admin User Registration

Title source: llm
STIX 2.1

Description

WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/renlok/WeBid/issues/530

Scores

CVSS v3 9.8
EPSS 0.0121
EPSS Percentile 64.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-697
Status published
Products (1)
webidsupport/webid 1.2.2
Published Jan 27, 2021
Tracked Since Feb 18, 2026