{"id":"CVE-2023-3222","aliases":["EUVD-2023-43900","GHSA-8j9j-8qff-cvrc"],"status":"published","title":"Vulnerability in the password recovery mechanism of Roundcube Password Recovery Plugin","description":"Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00674,"percentile":0.52416,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-640"],"published":"2023-09-04T12:49:47Z","modified":"2026-06-17T06:13:36Z","products":[{"vendor":"alfnru","product":"password recovery plugin"},{"vendor":"password_recovery_project","product":"password_recovery"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-roundcube-password-recovery-plugin","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3222"},{"url":"https://github.com/advisories/GHSA-8j9j-8qff-cvrc"}],"sources":{"cve":[{"id":"CVE-2023-3222","title":"Vulnerability in the password recovery mechanism of Roundcube Password Recovery Plugin","description":"Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.","status":"published","published":"2023-09-04T12:49:47.169Z","modified":"2024-09-30T18:46:16.475Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-43900","description":"Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.","status":"published","published":"2023-09-04T12:49:47Z","modified":"2024-09-30T18:46:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:01.909154Z"}],"ghsa":[{"id":"GHSA-8j9j-8qff-cvrc","title":"Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in...","description":"Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.","status":"published","published":"2023-09-04T15:30:38Z","modified":"2024-04-04T07:26:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:56:51.525022Z"}],"nvd":[{"id":"CVE-2023-3222","description":"Vulnerability in the password recovery mechanism of Password Recovery plugin for Roundcube, in its 1.2 version, which could allow a remote attacker to change an existing user´s password by adding a 6-digit numeric token. An attacker could create an automatic script to test all possible values because the platform has no limit on the number of requests.","status":"published","published":"2023-09-04T13:15:33.987Z","modified":"2026-06-17T06:13:36.86Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:08:27.181588Z"}]}}