Lucene search
MitreCVELIST:CVE-2020-26172HistoryDec 18, 2020 - 9:27 a.m.
CVE-2020-26172
2020-12-1809:27:50
mitre
www.cve.org
2
tangro business workflow
1.18.1
jwt token
token reuse
active session
CVSS3
4.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS
0.001
Percentile
45.3%
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.
Related
prion
prion
Code injection
2020-12-18 10:15:00
cve
cve
CVE-2020-26172
2020-12-18 10:15:12
nvd
nvd
CVE-2020-26172
2020-12-18 10:15:12
CVSS3
4.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS
0.001
Percentile
45.3%
Related for CVELIST:CVE-2020-26172