CVE-2022-29174

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-640

Affected software

No affected versions have been published.

Timeline

Published
May 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-291767.5Rubygems is a package registry used to supply software for the Ruby language ecosystem. Due to a bug in the yank action, it was possible forCVE-2022-291775.9Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to usCVE-2022-291788.2Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium priorCVE-2022-291798.2Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to verCVE-2022-291809.8A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the seCVE-2022-291818.2Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HCVE-2022-291825.4GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-basedCVE-2022-291836.1GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the piCVE-2022-291848.8GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissionsCVE-2022-291854.4totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to versionCVE-2022-291869.8Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise dCVE-2022-291877.8Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is v
CVE-2022-29174: High severity, CVSS 8.1 | Vulnix