CVE-2020-28874

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic

published January 21, 2021

CVSS
—
EPSS
2%
Percentile
83.8
In the wild
Unconfirmed
What it is

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02379 · 83.8th percentile
Published
2021-01-21T15:01Z
EPSS history
Timeline
  • 21 JAN 15:01Z
    reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic
    cvelistv5