CWE-640
Allowed-with-ReviewWeak Password Recovery Mechanism for Forgotten Password
Abstraction: Base · Status: Incomplete
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
421 vulnerabilities reference this CWE, most recent first.
GHSA-XRFH-P66C-M56H
Vulnerability from github – Published: 2022-05-17 02:40 – Updated: 2025-04-20 03:39QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.
{
"affected": [],
"aliases": [
"CVE-2017-7629"
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-15T20:29:00Z",
"severity": "HIGH"
},
"details": "QNAP QTS before 4.2.6 build 20170517 has a flaw in the change password function.",
"id": "GHSA-xrfh-p66c-m56h",
"modified": "2025-04-20T03:39:12Z",
"published": "2022-05-17T02:40:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7629"
},
{
"type": "WEB",
"url": "https://www.qnap.com/en-us/releasenotes"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
Mitigation
Do not use standard weak security questions and use several security questions.
Mitigation
Make sure that there is throttling on the number of incorrect answers to a security question. Disable the password recovery functionality after a certain (small) number of incorrect guesses.
Mitigation
Require that the user properly answers the security question prior to resetting their password and sending the new password to the e-mail address of record.
Mitigation
Never allow the user to control what e-mail address the new password will be sent to in the password recovery mechanism.
Mitigation
Assign a new temporary password rather than revealing the original password.
CAPEC-50: Password Recovery Exploitation
An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure.