CVE-2025-60954
BaseFortify
Publication date: 2025-10-24
Last updated on: 2025-10-28
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microweber | microweber | 2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-521 | The product does not require that users should have strong passwords. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Microweber CMS 2.0 has weak password requirements because it does not enforce minimum password length or complexity during password resets. This allows users to set very weak passwords, including single-character passwords, which increases the risk of account compromise, including for administrative accounts.
How can this vulnerability impact me? :
This vulnerability can lead to account compromise due to weak passwords, potentially allowing attackers to gain unauthorized access to user and administrative accounts. This can result in loss of confidentiality, integrity, and availability of the system and its data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately enforce strong password policies in Microweber CMS 2.0 by configuring or updating the application to require minimum password length and complexity during password resets. Ensure that users cannot set weak passwords such as single-character passwords. Additionally, review and reset passwords for administrative accounts to comply with strong password requirements.