Lucene search

GoogleOSV:CVE-2020-28874

HistoryJan 26, 2021 - 6:15 p.m.

CVE-2020-28874

2021-01-2618:15:51

Google

osv.dev

projectsend

reset

vulnerability

password

incorrect logic

remote attackers

AI Score

7.1

Confidence

High

EPSS

0.004

Percentile

73.9%

JSON

reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).

References

projectsend.com

github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e

github.com/projectsend/projectsend/commits/master

github.com/projectsend/projectsend/releases/tag/r1295

github.com/varandinawer/CVE-2020-28874