CVE-2020-27422 Business logic in n/a
Attackers can reuse expired password reset links to take over user accounts in Anuko Time Tracker due to missing token invalidation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27422?
CVE-2020-27422 is a critical vulnerability in n/a, published on 16 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
Weakness: CWE-613
Which versions are affected by CVE-2020-27422?
It affects 1 product.
Products include Anuko Time Tracker.
How do I fix CVE-2020-27422?
No fix has been published for CVE-2020-27422 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-27422 being exploited?
There is no known exploitation of CVE-2020-27422 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
- CVE-2023-32306 Time Tracker has Blind SQL Injection Vulnerability in Reports
- CVE-2020-15255 CSV injection in Anuko Time Tracker
- CVE-2023-32308 SQL Injection Vulnerability in anuko timetracker
- CVE-2021-43851 SQL injection vulnerability in anuko timetracker
- CVE-2021-41139 Reflected XSS vulnerability in time.php
Sources
Also known as GHSA-jvmc-9qmp-g6pw.