CVE-2021-28293
Critical
Description
Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. The lack of correct configuration leads to recovery of the password reset link generated via the password reset functionality, and thus an unauthenticated attacker can set an arbitrary password for any user.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSeceon Aisiem
PublishedJun 8, 2021
First seenJun 8, 2021
How to fix
Update
- seceon aisiem6.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| seceon aisiem | v < 6.3.2 | 6.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.