CVE-2020-28597CWE-337

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21

Critical · published March 3, 2021

CVSS v3.0
9.8
EPSS
1%
Percentile
64.6
In the wild
Unconfirmed
What it is

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.

The record
Technical detail
CVSS v3.0
9.8 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01072 · 64.6th percentile
Weakness
CWE-337 · Predictable Seed in Pseudo-Random Number Generator (PRNG)
Published
2021-03-03T17:47Z
EPSS history
Timeline
  • 03 MAR 17:47Z
    A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21
    cvelistv5