VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Nov 24, 2020· Updated Jun 17, 2026

CVE-2020-7378

CVE-2020-7378

Description

CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen value. This issue was resolved in version 5.0-20200904, released September 4, 2020.

Affected products

2
  • Crisp/Opencrxllm-create2 versions
    <=4.30, <=5.0-20200717+ 1 more
    • (no CPE)range: <=4.30, <=5.0-20200717
    • (no CPE)range: 4.30

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.