CVE-2024-6890

2024-08-0723:15:41

CWE-799

CWE-798

CWE-321

CWE-334

KoreLogic

web.nvd.nist.gov

password reset

insecure randomness

brute force

administrator password

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

20.0%

JSON

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

Affected configurations

Nvd

Node

journyxjournyxMatch11.5.4linux

VendorProductVersionCPE
journyxjournyx11.5.4cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:linux:*:*

Vendor	Product	Version	CPE
journyx	journyx	11.5.4	cpe:2.3:a:journyx:journyx:11.5.4:::::linux::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "Journyx (jtime)",
    "vendor": "Journyx",
    "versions": [
      {
        "status": "affected",
        "version": "11.5.4"
      }
    ]
  }
]