CVE-2022-29174

Name of the Vulnerable Software and Affected Versions countly-server versions prior to 22.03.7 countly-server versions prior to 21.11.4

Description The issue is related to a weakness in the password recovery mechanism of countly-server, allowing a remote attacker to change a user's password and gain elevated privileges. An attacker who knows an account's email address/username and full name specified in the database can guess the password reset token, use this information to reset the password, and take over the account.

Recommendations For versions prior to 22.03.7, update to version 22.03.7 or later for servers using the new user interface. For versions prior to 21.11.4, update to version 21.11.4 or later for servers using the old user interface.