PT-2020-15947
CVE-2020-25105
·
Published
2020-09-03
·
Updated
2020-09-10
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
eramba versions c2.8.1 and earlier, eramba Enterprise versions prior to e2.19.3
Description
The issue is related to a weak password recovery token. Specifically, the
createHash function has only a million possibilities, which is considered insecure.Recommendations
For eramba versions c2.8.1 and earlier, update to a version later than c2.8.1.
For eramba Enterprise versions prior to e2.19.3, update to version e2.19.3 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾