CVE-2024-6890 Journyx Unauthenticated Password Reset Bruteforce

2024-08-0723:09:40

CWE-334

CWE-799

CWE-321

KoreLogic

www.cve.org

cve-2024-6890

journyx

password reset

security

brute-force

EPSS

0.001

Percentile

20.0%

JSON

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "Journyx (jtime)",
    "vendor": "Journyx",
    "versions": [
      {
        "status": "affected",
        "version": "11.5.4"
      }
    ]
  }
]

References

korelogic.com/Resources/Advisories/KL-001-2024-007.txt

EPSS

0.001

Percentile

20.0%

JSON

Related for CVELIST:CVE-2024-6890