CVE-2022-30935

CVE-2022-30935 is a critical authorization bypass vulnerability affecting b2evolution, including version 7.2.3 and potentially earlier versions. The flaw stems from a weak randomness function used in password reset token generation, enabling remote, unauthenticated attackers to predict these tokens. This allows attackers to gain valid sessions for arbitrary users, potentially leading to full account compromise and password resets. With a CVSS score of 9.1 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in high confidentiality and integrity impacts. While no public exploit code (Metasploit, Nuclei, ExploitDB) or active exploitation (KEV) has been observed, and community discussion is minimal, the high FAUCET Risk Score of 74/100 indicates its significant potential for exploitation.