CVE-2022-30935 is a critical security vulnerability identified in b2evolution, a content management system (CMS) widely used for blogging and website management. The vulnerability arises from an authorization bypass caused by the use of a weak randomness function in generating password reset tokens. Specifically, the randomness function used to create these tokens is predictable, allowing remote and unauthenticated attackers to guess valid password reset tokens for any user account. Exploiting this flaw, an attacker can obtain valid sessions for arbitrary users without needing any prior authentication or user interaction. This capability extends to resetting the passwords of targeted accounts, effectively granting the attacker full control over those accounts. The vulnerability has been confirmed in version 7.2.3 of b2evolution, with earlier versions also affected, potentially including earlier major releases. The weakness corresponds to CWE-330, which relates to the use of insufficiently random values in security-critical contexts. The CVSS v3.1 base score is 9.1, indicating a critical severity level, with an attack vector of network (AV:N), no privileges required (PR:N), no user interaction (UI:N), and impacts on confidentiality and integrity (C:H/I:H) but not availability (A:N). No known exploits are currently reported in the wild, but the vulnerability's nature makes it a high-risk target for attackers seeking to compromise user accounts and gain unauthorized access to CMS-managed websites.

For European organizations using b2evolution as their CMS platform, this vulnerability poses a significant threat. Attackers exploiting this flaw can hijack user accounts, including administrative accounts, leading to unauthorized access to sensitive data, website defacement, or insertion of malicious content such as malware or phishing pages. This can result in reputational damage, loss of customer trust, and potential regulatory penalties under GDPR if personal data is compromised. The ability to reset passwords without authentication also undermines the integrity of user management processes. Since b2evolution is used by various small to medium enterprises, non-profits, and educational institutions across Europe, the risk extends to sectors that may have limited cybersecurity resources, increasing their vulnerability. Additionally, compromised websites can be leveraged as part of larger attack campaigns, such as distributing malware or conducting phishing attacks targeting European users. The lack of user interaction and authentication requirements makes exploitation straightforward, increasing the likelihood of successful attacks if patches or mitigations are not applied promptly.

European organizations should immediately assess their use of b2evolution CMS and identify affected versions, particularly version 7.2.3 and earlier. Since no official patch links are provided, organizations should monitor the b2evolution project for security updates or advisories addressing this issue. In the interim, administrators should consider disabling password reset functionality or implementing additional verification steps (e.g., CAPTCHA, email confirmation with unpredictable tokens) to mitigate token prediction risks. Enhancing server-side logging and monitoring for unusual password reset requests or session creations can help detect exploitation attempts early. Organizations should also enforce strong password policies and encourage users to enable multi-factor authentication (MFA) if supported by the platform. If feasible, migrating to alternative CMS platforms with robust security track records may be considered. Regular backups and incident response plans should be updated to prepare for potential account compromises. Finally, educating users about phishing and suspicious account activities can reduce the impact of successful exploits.