CVE-2025-66225
BaseFortify
Publication date: 2025-11-29
Last updated on: 2025-12-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| orangehrm | orangehrm | From 5.0 (inc) to 5.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-640 | The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in OrangeHRM versions 5.0 to 5.7 involves the password reset workflow not verifying that the username submitted in the final reset request matches the account for which the reset was initiated. An attacker who obtains a valid reset link for any account they can receive email for can modify the username parameter to reset the password of a different user, including privileged accounts, leading to full account takeover. This flaw was fixed in version 5.8.
How can this vulnerability impact me? :
The vulnerability allows an attacker to take over any user account, including privileged accounts, by resetting their passwords without proper verification. This can lead to unauthorized access, data breaches, and potential misuse of sensitive HR information within the OrangeHRM system.
What immediate steps should I take to mitigate this vulnerability?
Upgrade OrangeHRM to version 5.8 or later, where the vulnerability has been patched. Until the upgrade can be performed, restrict access to the password reset functionality and monitor for suspicious password reset activities.