CVEvulnerability

CVE-2024-6890

8.8 HIGH Published 2024-08-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-08-07
Last modified
2026-06-17
Assigner
bbf0bd87-ece2-41be-b873-96928ee8fab9
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-321, CWE-334, CWE-798, CWE-799

Description

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

Affected configurations

• journyx journyx 11.5.4

Related

Weakness · CWE (4)

  • CWE-321 Use of Hard-coded Cryptographic Key weakness
  • CWE-334 Small Space of Random Values weakness
  • CWE-798 Use of Hard-coded Credentials weakness
  • CWE-799 Improper Control of Interaction Frequency weakness

References