CVE-2023-3222

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-640

Affected software

VendorProductVersions
AlfnRUPassword Recovery Plugin1.2

References

Timeline

Published
Sep 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-322209.8Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.CVE-2023-322217.8EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation.CVE-2023-322229.8D-Link DSL-G256DG version vBZ_1.00.27 web management interface allows authentication bypass via an unspecified method.CVE-2023-322238.8D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.CVE-2023-322249.8D-Link DSL-224 firmware version 3.0.10 CWE-307: Improper Restriction of Excessive Authentication AttemptsCVE-2023-322257.2Sysaid - CWE-434: Unrestricted Upload of File with Dangerous Type -  A malicious user with administrative privileges may be able to upload CVE-2023-322266.5Sysaid - CWE-552: Files or Directories Accessible to External Parties -  Authenticated users may exfiltrate files from the server via an uCVE-2023-322279.8Synel SYnergy Fingerprint Terminals - CWE-798: Use of Hard-coded CredentialsCVE-2023-322284.6A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last CVE-2023-322296.5Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanenCVE-2023-32237.5A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This maCVE-2023-322307.5An improper handling of a malformed API request to an API server in Bosch BT software products can allow an unauthenticated attacker to caus