CVE-2024-6890 Journyx Unauthenticated Password Reset Bruteforce
Attackers can brute-force administrator passwords due to insecure token generation, leading to full account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6890?
CVE-2024-6890 is a critical vulnerability in Journyx (jtime), published on 7 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.
Which versions are affected by CVE-2024-6890?
It affects 1 product.
Products include Journyx Journyx.
How do I fix CVE-2024-6890?
No fix has been published for CVE-2024-6890 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-6890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6890 exists.
Other vulnerabilities in Journyx (jtime)
Sources
Also known as GHSA-4rc5-7v2h-gq36.