PT-2020-16687
CVE-2020-27422
·
تاريخ النشر
2020-11-16
·
تاريخ التحديث
2020-11-30
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Anuko Time Tracker version 1.19.23.5311
Description
The password reset link emailed to the user does not expire once used, allowing an attacker to use the same link to take over the account.
Recommendations
For Anuko Time Tracker version 1.19.23.5311, consider implementing a mechanism to expire the password reset link after its first use to prevent account takeover. As a temporary workaround, restrict access to password reset functionality until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾