CVE-2020-27422

CRITICAL

9.8

Description

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published11/16/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

anuko:time_tracker

Weaknesses (CWE)

CWE-613

References

https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html(cve@mitre.org)

https://www.anuko.com/time-tracker/index.htm(cve@mitre.org)

https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.anuko.com/time-tracker/index.htm(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.