CVE-2020-26172

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active

Medium · published December 18, 2020

CVSS v3.1
4.2
EPSS
1%
Percentile
50.9
In the wild
Unconfirmed
What it is

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AC:H/AV:N/A:N/C:L/I:L/PR:N/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00660 · 50.9th percentile
Published
2020-12-18T09:27Z
EPSS history
Timeline
  • 18 DEC 09:27Z
    Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active
    cvelistv5