CVE-2023-4448

MEDIUM

OpenRapid RapidCMS 1.3.1 - Weak Password Recovery Mechanism in admin/run-movepass.php

Title source: llm

Description

A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.

References (4)

Core 4

Core References

Third Party Advisory vdb-entry technical-description

https://vuldb.com/?id.237569

Permissions Required, Third Party Advisory signature permissions-required

https://vuldb.com/?ctiid.237569

Issue Tracking, Patch exploit issue-tracking

https://github.com/OpenRapid/rapidcms/issues/5

Patch patch

https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbe#diff-fc57d4c69cf5912c6edb5233c6df069a91106ebd481c115faf1ea124478b26d0

View Patch ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.0054

EPSS Percentile 41.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-640

Status published

Products (1)

openrapid/rapidcms 1.3.1

Published Aug 21, 2023

Tracked Since Feb 18, 2026