CVEvulnerability
CVE-2021-27200
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-330
Description
In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.
Affected configurations
• wowonder wowonder 3.0.4
Related
Weakness · CWE (1)
- CWE-330 Use of Insufficiently Random Values weakness
References
- https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-27200 Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/49989 Exploit, Third Party Advisory, VDB Entry
- https://www.wowonder.com Product
- https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-27200 Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/49989 Exploit, Third Party Advisory, VDB Entry
- https://www.wowonder.com Product