This vulnerability in macrozheng mall 0504e86 involves a weakness in the password recovery process within the /sso/getAuthCode endpoint of the mall-portal module. The flaw can be exploited remotely but requires high attack complexity and no privileges or user interaction. Although an exploit exists publicly, the vendor has not issued any advisory or patch and has not responded to disclosure communications. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.3.

Successful exploitation could allow an attacker to bypass or weaken the password recovery process, potentially leading to unauthorized account access. However, the high attack complexity and lack of privileges required reduce the likelihood of widespread exploitation. There is no evidence of active exploitation in the wild.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation guidance exists, users should monitor for updates from the vendor or community. Consider implementing additional protective controls around password recovery processes if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.