CyberRota Analysis
AI-GeneratedKiteworks Core is vulnerable due to improper validation in its password reset workflow, allowing unauthenticated attackers to reset user passwords if they know the associated email address. This critical flaw could enable attackers to gain unauthorized access to user accounts, including those with administrative privileges. Organizations using Kiteworks Core should prioritize immediate remediation to protect sensitive user data and prevent account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.