VulnerabilityModified
CVE-2024-6890
Password reset tokens are generated using an insecure source of randomness.
HIGH 8.8EPSS 0.72%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-321, CWE-334, CWE-799, CWE-798
- Affected
- journyx/journyx
- Source
- bbf0bd87-ece2-41be-b873-96928ee8fab9
References
- https://korelogic.com/Resources/Advisories/KL-001-2024-007.txtExploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Aug/5
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.