by Kastro
Paper/Archive/CVE-2021-27200

CVE-2021-27200

mitre — In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php.

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.7.887 × 2017.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwowonder.comrefsecurityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-27200refexploit-db.com/exploits/49989