CVE-2022-30935: Critical severity evolution vulnerability
An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any user through the use of a bad randomness function. This allows the attacker to get valid sessions for arbitrary users, and optionally reset their password. Tested and confirmed in a default installation of version 7.2.3. Earlier versions are affected, possibly earlier major versions as well.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30935?
CVE-2022-30935 has been rated as a critical vulnerability due to its potential impact on user accounts.
How do I fix CVE-2022-30935?
To fix CVE-2022-30935, it is recommended to update b2evolution to version 7.2.5 or later.
Who is affected by CVE-2022-30935?
CVE-2022-30935 affects all users of b2evolution versions prior to 7.2.5.
What type of attack does CVE-2022-30935 support?
CVE-2022-30935 allows remote attackers to perform authorization bypass attacks and reset passwords.
Can CVE-2022-30935 be exploited without authentication?
Yes, CVE-2022-30935 can be exploited by unauthenticated attackers, making it particularly dangerous.