| Package | Affected versions | Patched versions |
|---|---|---|
| kiteworks | < 9.5.0 | 9.5.0 |
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free