CVE-2021-31646 Weak cryptography in n/a
Weak password recovery token generation in Gestsup allows remote attackers to brute force tokens and take over user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-31646?
CVE-2021-31646 is a critical vulnerability in n/a, published on 26 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses a weak algorithm for the generation of password recovery tokens (the PHP uniqueid function), allowing a brute force attack.
Weakness: CWE-307
Which versions are affected by CVE-2021-31646?
It affects 1 product.
Products include Gestsup Gestsup.
How do I fix CVE-2021-31646?
No fix has been published for CVE-2021-31646 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-31646 being exploited?
There is no known exploitation of CVE-2021-31646 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-22194 GestSup <= 3.2.60 CSRF Allows Privileged Actions
- CVE-2026-22195 GestSup < 3.2.60 SQL Injection in Search Bar
- CVE-2026-22196 GestSup < 3.2.60 SQL Injection in Ticket Creation
- CVE-2026-22197 GestSup < 3.2.60 Multiple SQL Injections in Asset List
- CVE-2023-52059 Cross-site scripting in n/a
Sources
Also known as GHSA-whcv-8x9m-33fh.