CVE-2024-28270

Published April 8th, 2024

View on NVD ↗

CVSS v3

8.1

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.

bcvgh/web-flash-Broken-Access-Control-vulnerability

web-flash v3.0 Broken Access Control vulnerability

GitHub