CVE-2023-43902: Critical severity eMudhra EMSigner vulnerability

Published Nov 14, 2023

Updated

Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token.

Affected Software

1 affected component

eMudhra EMSigner=2.8.7

Event History

Nov 14, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2023-43902.

What is the title of this vulnerability?

The title of this vulnerability is 'Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token.'

What is the severity of CVE-2023-43902?

The severity of CVE-2023-43902 is critical with a severity score of 9.8.

Which software version is affected by CVE-2023-43902?

The software version affected by CVE-2023-43902 is EMSigner v2.8.7.

How can an unauthenticated attacker exploit CVE-2023-43902?

An unauthenticated attacker can exploit CVE-2023-43902 by using a crafted password reset token to access accounts of all registered users, including those with administrator privileges.