CVEvulnerability
CVE-2020-27422
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-11-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-613
Description
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
Affected configurations
• anuko time tracker (<= 1.19.23.5311)
Related
Weakness · not in database (1)
References
- https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html Third Party Advisory, VDB Entry
- https://www.anuko.com/time-tracker/index.htm Product, Vendor Advisory
- https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html Third Party Advisory, VDB Entry
- https://www.anuko.com/time-tracker/index.htm Product, Vendor Advisory