VulnerabilityModified
CVE-2021-27200
In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php.
CRITICAL 9.8EPSS 3.36%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.36% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-330
- Affected
- wowonder/wowonder
- Source
- cve@mitre.org
References
- https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-27200Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/49989Exploit, Third Party Advisory, VDB Entry
- https://www.wowonder.comProduct
- https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-27200Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/49989Exploit, Third Party Advisory, VDB Entry
- https://www.wowonder.comProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.