CVE-2020-25728 describes a critical vulnerability in the Alfresco Reset Password add-on prior to version 1.2.0, where a flawed password reset algorithm allows any authenticated user to change the password of any other user, including the administrator. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, the potential for a complete compromise of an Alfresco instance makes remediation crucial.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.2.0CPE matchmatch criteria | cpe:2.3:a:alfresco:reset_password:*:*:*:*:*:alfresco:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.