CVE-2024-6890 Journyx Unauthenticated Password Reset Bruteforce

2024-08-0723:09:40

CWE-321

CWE-334

CWE-799

KoreLogic

github.com

cve-2024-6890

journyx

unauthenticated

password reset

brute force

administrator

AI Score

7.2

Confidence

Low

EPSS

0.001

Percentile

20.0%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:journyx:journyx:11.5.4:*:*:*:*:*:*:*"
    ],
    "vendor": "journyx",
    "product": "journyx",
    "versions": [
      {
        "status": "affected",
        "version": "11.5.4"
      }
    ],
    "defaultStatus": "unknown"
  }
]