CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It may be remotely exploitable.
CVE
CVE-2015-8707
Severity
CRITICAL
CVSS
9.8
EPSS
1.32%
Original NVD Description
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
Related CVEs
Other vulnerabilities affecting the same vendor(s)