CVE-2025-29995
This vulnerability exists in the CAP back office application due to a weak password-reset mechanism implemented at API endpoints. An authenticated remote attacker with a valid login ID could exploit this vulnerability through vulnerable API endpoint which could lead to account takeover of targeted users.
- Score
- CVSS 4.0 8.3 High
- Status
- Deferred - vdisclose@cert-in.org.in
- Published
- 2025-03-13
- Last modified
- 2025-03-13
- Weaknesses
- CWE-640
Affected products
References
- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0048
