High severity · published May 17, 2022
CVE-2022-29174
Predictable password reset token may lead to account takeover in countly-server
8.1
CVSS
1.5%
EPSS
No
On KEV
Description
countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
countly-server · Countly
< 21.11.4; >= 22.0.0, < 22.03.7 · source: vendor
CS
Countly Server · Count
before 21.11.4; 22.03 before 22.03.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29174
Patch
https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999
Patch
https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v
More from countly-server
9.0
CVE-2026-44977
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
9.0
CVE-2021-32852
countly-server vulnerable to Cross-site Scripting
8.1
CVE-2026-42269
countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
7.5
CVE-2026-41582
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
7.5
CVE-2026-42270
countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception