CVE-2020-28597

State: Published
Severity: 9.8 Critical
Published: Mar 3, 2021
Updated: Aug 4, 2024
Reserved: Nov 13, 2020

Description

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.

Scores

CVSS	Score	Vector	Source
3.0	9.8 Critical	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	talos

Weaknesses

CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)

Affected Products

Product	Versions
Epignosisn/a	Epignosis eFront LMS 5.2.17, Epignosis eFront LMS 5.2.21Affected

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.