CVE-2022-29174

countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.

• CWE-640

• https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999Patch, Third Party Advisory
• https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23vPatch, Third Party Advisory
• https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999Patch, Third Party Advisory
• https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23vPatch, Third Party Advisory

Published

May 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29168Wire is a secure messaging application. Wire is vulnerable t…6.1
• CVE-2022-29169BigBlueButton is an open source web conferencing system. Ver…7.5
• CVE-2022-29170Grafana is an open-source platform for monitoring and observ…8.5
• CVE-2022-29171Sourcegraph is a fast and featureful code search and navigat…7.2
• CVE-2022-29172Auth0 is an authentication broker that supports both social …6.1
• CVE-2022-29173go-tuf is a Go implementation of The Update Framework (TUF).…8.8
• CVE-2022-29175Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-29176Rubygems is a package registry used to supply software for t…7.5
• CVE-2022-29177Go Ethereum is the official Golang implementation of the Eth…5.9
• CVE-2022-29178Cilium is open source software for providing and securing ne…8.2
• CVE-2022-29179Cilium is open source software for providing and securing ne…8.2
• CVE-2022-29180A vulnerability in which attackers could forge HTTP requests…9.8