CVE-2015-8267
moderate-risk
Published 2015-12-24
The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.0.4.0 allows remote attackers to reset arbitrary passwords via a crafted request with a valid username.
Do I need to act?
~
2.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
10
CVSS 10.0/10
Critical
NETWORK
/ LOW complexity
Affected Products (1)
Ad Self Password Reset
Affected Vendors
References (6)
Third Party Advisory
https://www.kb.cert.org/vuls/id/757840
Third Party Advisory
https://www.kb.cert.org/vuls/id/757840
44
/ 100
moderate-risk
Severity
33/34 · Critical
Exploitability
6/34 · Minimal
Exposure
5/34 · Minimal