Read the docs
TI-2022-11718 Aliases CVE-2022-29174

Predictable password reset token may lead to account takeover in countly-server

Priority MEDIUM 40CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01479 74th percentileScored 2026-11-07
Fix Fixed countly-server (Countly): 21.11.4, 22.03.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Countlycountly-serverbefore 21.11.4; 22.0.0 to before 22.03.721.11.4, 22.03.7Patch availableCNA
  • countly-server VendorCountly Affected before 21.11.4; 22.0.0 to before 22.03.7 Fixed in 21.11.4, 22.03.7 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:count:countly_server:*:*:*:*:*:*:*:*before 21.11.4; 22.03 to before 22.03.7VulnerableCount
  • cpe:2.3:a:count:countly_server:*:*:*:*:*:*:*:* Versions before 21.11.4; 22.03 to before 22.03.7 Vulnerable ·Count

Remediation

  • Fix · CNA countly-server (Countly) Fixed in 21.11.4, 22.03.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-29174

References

Patch 2

  • TI-2026-75341 Stored XSS in countly-server feedback upload exposes global admin session CVSS 3.1CRITICAL 9.0
  • TI-2026-75340 Unauthenticated denial of service in countly-server image routes CVSS 3.1HIGH 7.5
  • TI-2026-75338 Path traversal in countly-server exposes arbitrary server files CVSS 3.1HIGH 7.5
  • TI-2026-75339 Path traversal in countly-server lets users delete files CVSS 3.1HIGH 8.1
  • TI-2026-59922 Incorrect authorization in countly-server CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences