CVE-2024-6890CWE-321CWE-334CWE-799

Journyx Unauthenticated Password Reset Bruteforce

Critical · published August 7, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00717 · 53.3th percentile
Weaknesses
CWE-321 · Use of Hard-coded Cryptographic Key; CWE-334 · Small Space of Random Values; CWE-799 · Improper Control of Interaction Frequency
Published
2024-08-07T23:09Z
EPSS history
Timeline
  • 07 AUG 23:09Z
    Journyx Unauthenticated Password Reset Bruteforce
    cvelistv5