# CWE-640.

Every Advisory and CVE whose sources give the weakness CWE-640, newest first.

## Records, newest first (an older page)

- [Contao Does Not Invalidate Existing Sessions When Password Changes](https://agentprime.io/advisories/GHSA-vcgg-hp4r-87gx.md)
  `GHSA-vcgg-hp4r-87gx`, `CVE-2019-10641`, `PKSA-4b38-qncw-d1nq`, `PKSA-62kn-sxm4-zf9x`, `PKSA-fcyb-3n6p-v7sp` · Packagist `contao/contao` and 2 more: affected `>=4.0.0, <4.4.37 || >=4.5.0, <4.7.3`, fixed in `4.4.37`, `4.7.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: CWE-640
- [MantisBT allows arbitrary password reset](https://agentprime.io/advisories/GHSA-252r-f55f-ff34.md)
  `GHSA-252r-f55f-ff34`, `CVE-2017-7615`, `PKSA-g674-s94j-gf23` · Packagist `mantisbt/mantisbt`: affected `>=1.3.0-rc.2, <1.3.10 || >=2.0.0, <2.2.4 || >=2.3.0, <2.3.1`, fixed in `1.3.10`, `2.2.4`, `2.3.1` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.91 · Not analysed yet · Published 13 May 2022 · Tags: CWE-640
- [Moodle Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/GHSA-2phx-w35g-x9vm.md)
  `GHSA-2phx-w35g-x9vm`, `CVE-2016-7038`, `PKSA-gypm-xnhz-46q4` · Packagist `moodle/moodle`: affected `>=2.7, <2.7.16 || >=2.9, <2.9.8 || >=3.0, <3.0.6 || >=3.1, <3.1.2`, fixed in `2.7.16`, `2.9.8`, `3.0.6`, `3.1.2` · CVSS 7.3 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-640
- [Pagekit Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/GHSA-rp89-32rp-qpq2.md)
  `GHSA-rp89-32rp-qpq2`, `CVE-2017-5594`, `PKSA-19by-w8m1-5td2` · Packagist `pagekit/pagekit`: affected `<1.0.11`, fixed in `1.0.11` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: CWE-640
- [Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/GHSA-fj69-p8f6-q97h.md)
  `GHSA-fj69-p8f6-q97h`, `CVE-2015-3189` · Maven `org.cloudfoundry.identity:cloudfoundry-identity-server`: affected `<2.2.5`, fixed in `2.2.5` · CVSS 3.7 Low · Not analysed yet · Published 13 May 2022 · Tags: CWE-640
- [Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/GHSA-cq6m-74r4-x77g.md)
  `GHSA-cq6m-74r4-x77g`, `CVE-2015-5172` · Maven `org.cloudfoundry.identity:cloudfoundry-identity-server`: affected `<2.5.2`, fixed in `2.5.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022 · Tags: CWE-640
- [Improper account password reset in Craft CMS](https://agentprime.io/advisories/GHSA-5cjr-78cq-3wrg.md)
  `GHSA-5cjr-78cq-3wrg`, `CVE-2022-29933`, `PKSA-61st-bdmf-2n6s` · Packagist `craftcms/cms`: affected `<3.7.36`, fixed in `3.7.36` · CVSS 8.8 High · Not analysed yet · Published 10 May 2022 · Tags: CWE-640
- [Multiple valid tokens for password reset in Shopware](https://agentprime.io/advisories/GHSA-3qrq-r688-vvh4.md)
  `GHSA-3qrq-r688-vvh4`, `CVE-2022-24892`, `PKSA-kj6m-y9zg-sf82` · Packagist `shopware/shopware`: affected `>=5.0.4, <5.7.9`, fixed in `5.7.9` · CVSS 6.4 Medium · Not analysed yet · Published 28 Apr 2022 · Tags: CWE-640
- [Automatic Question Paper Generator password recovery](https://agentprime.io/advisories/CVE-2022-1073.md)
  `CVE-2022-1073` · CVE record: unspecified Automatic Question Paper Generator · CVSS 7.3 High · Not analysed yet · Published 29 Mar 2022 · Tags: CWE-640
- [Rate limit missing in microweber](https://agentprime.io/advisories/GHSA-7r79-mrp6-8mhq.md)
  `GHSA-7r79-mrp6-8mhq`, `CVE-2022-0777`, `PKSA-c5ch-hxm2-mtnd` · Packagist `microweber/microweber`: affected `<1.3`, fixed in `1.3` · CVSS 7.3 High · Not analysed yet · Published 2 Mar 2022 · Tags: CWE-640
- [Information exposure in xwiki-platform](https://agentprime.io/advisories/GHSA-35fg-hjcr-j65f.md)
  `GHSA-35fg-hjcr-j65f`, `CVE-2022-23619` · Maven `org.xwiki.platform:xwiki-platform-web`: affected `>=13.5RC1, <13.6RC1 || >=13.0.0, <13.4.1 || <12.10.9`, fixed in `13.6RC1`, `13.4.1`, `12.10.9` · CVSS 5.3 Medium · Not analysed yet · Published 9 Feb 2022 · Tags: Information disclosure, CWE-640
- [Weak password recovery in Pegasystems Pega Infinity](https://agentprime.io/advisories/CVE-2021-27654.md)
  `CVE-2021-27654` · CVE record: Pegasystems Pega Infinity · CVSS 8.8 High · Not analysed yet · Published 28 Jan 2022 · Tags: CWE-640
- [Umbraco Persistent Password Reset Poison](https://agentprime.io/advisories/GHSA-r8pr-83cc-ccv7.md)
  `GHSA-r8pr-83cc-ccv7`, `CVE-2022-22691` · NuGet `Umbraco.Cms.Core`: affected `<9.2.0`, fixed in `9.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 21 Jan 2022 · Tags: HTTP request smuggling, CWE-640
- [Weak Password Recovery Mechanism for Forgotten Password in Strapi](https://agentprime.io/advisories/GHSA-37hx-4mcq-wc3h.md)
  `GHSA-37hx-4mcq-wc3h`, `CVE-2021-28128` · npm `strapi`: affected `<=3.6.0`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2021 · Tags: CWE-640
- [SuiteCRM - Account Takeover in Password Reset Functionality](https://agentprime.io/advisories/CVE-2021-25961.md)
  `CVE-2021-25961` · CVE record: salesagility SuiteCRM · CVSS 8.0 High · Not analysed yet · Published 29 Sept 2021 · Tags: CWE-640
- [Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/GHSA-c32w-3cqh-f6jx.md)
  `GHSA-c32w-3cqh-f6jx`, `CVE-2021-25957`, `PKSA-kb2t-w5sd-kvm6` · Packagist `dolibarr/dolibarr`: affected `<14.0.0`, fixed in `14.0.0` · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2021 · Tags: CWE-640
- [Malicious password-reset in Akaunting](https://agentprime.io/advisories/GHSA-246r-r2wf-frhx.md)
  `GHSA-246r-r2wf-frhx`, `CVE-2021-36804`, `PKSA-gy8j-mq9c-p1gm` · Packagist `akaunting/akaunting`: affected `<2.1.13`, fixed in `2.1.13` · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2021 · Tags: CWE-640
- [Re-use of email tokens in Discourse](https://agentprime.io/advisories/CVE-2021-37693.md)
  `CVE-2021-37693` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2021 · Tags: Authentication bypass, CWE-640
- [Weak password recovery in PowerLogic PM55xx, PowerLogic PM8ECC…](https://agentprime.io/advisories/CVE-2021-22763.md)
  `CVE-2021-22763` · CVE record: PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2021 · Tags: CWE-640
- [Weak password recovery in Modicon Managed Switch MCSESM\* and MCSESP\* V8.21 and prior](https://agentprime.io/advisories/CVE-2021-22731.md)
  `CVE-2021-22731` · CVE record: Modicon Managed Switch MCSESM\* and MCSESP\* V8.21 and prior · No CVSS score · Not analysed yet · Published 26 May 2021 · Tags: CWE-640
- [Indico Tampering with links (e.g. password reset) in sent emails](https://agentprime.io/advisories/GHSA-wgpj-7c2j-vfjm.md)
  `GHSA-wgpj-7c2j-vfjm`, `CVE-2021-30185`, `PYSEC-2021-18` · PyPI `indico`: affected `<2.3.4`, fixed in `2.3.4` · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2021 · Tags: CWE-640
- [Weak password recovery in Dell CPG BIOS](https://agentprime.io/advisories/CVE-2020-5361.md)
  `CVE-2020-5361` · CVE record: Dell CPG BIOS · CVSS 5.1 Medium · Not analysed yet · Published 4 Jan 2021 · Tags: CWE-640
- [Weak password recovery in Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and…](https://agentprime.io/advisories/CVE-2019-6560.md)
  `CVE-2019-6560` · CVE record: Auto-Maskin RP210E Versions 3.7 and prior DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App) · No CVSS score · Not analysed yet · Published 23 Mar 2020 · Tags: CWE-640
- [Django Potential account hijack via password reset form](https://agentprime.io/advisories/GHSA-vfq6-hq5r-27r6.md)
  `GHSA-vfq6-hq5r-27r6`, `CVE-2019-19844`, `PYSEC-2019-16` · PyPI `django`: affected `<1.11.27 || >=2.0, <2.2.9 || >=3.0, <3.0.1`, fixed in `1.11.27`, `2.2.9`, `3.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.54 · Not analysed yet · Published 16 Jan 2020 · Tags: CWE-640
- [Strapi allows unauthenticated attacker to reset admin password without valid reset token](https://agentprime.io/advisories/GHSA-6xc2-mj39-q599.md)
  `GHSA-6xc2-mj39-q599`, `CVE-2019-18818` · npm `strapi`: affected `<3.0.0-beta.17.5`, fixed in `3.0.0-beta.17.5` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.98 · Not analysed yet · Published 2 Dec 2019 · Tags: CWE-640
- [Weak password recovery in Forcepoint Email Security](https://agentprime.io/advisories/CVE-2018-16529.md)
  `CVE-2018-16529` · CVE record: Forcepoint Forcepoint Email Security · No CVSS score · Not analysed yet · Published 28 Mar 2019 · Tags: CWE-640
- [ASP.NET Core allow an elevation of privilege](https://agentprime.io/advisories/GHSA-365p-96qv-xr7g.md)
  `GHSA-365p-96qv-xr7g`, `CVE-2018-0787` · NuGet `Microsoft.AspNetCore.HttpOverrides` and 1 more: affected `>=2.0.0, <2.0.2`, fixed in `2.0.2` · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2018 · Tags: CWE-640

Newest: <https://agentprime.io/advisories/tag/cwe-640.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-640&cursor=WyIyMDIyLTA1LTE3VDAyOjQ2OjEwLjAwMDAwMFoiLCJHSFNBLWoyN2ctcjU4cS02MjR3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-640/?cursor=WyIyMDIyLTA1LTE3VDAyOjQ2OjEwLjAwMDAwMFoiLCJHSFNBLWoyN2ctcjU4cS02MjR3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.