by Kastro
Paper/Archive/CVE-2020-27422

CVE-2020-27422

mitre — In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use th…

EPSS 8%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.7.947 × 2018.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refanuko.com/time-tracker/index.htmrefpacketstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html