CVE-2024-6890

Journyx Unauthenticated Password Reset Bruteforce

State: Published
Severity: 9.8 Critical
Published: Aug 7, 2024
Updated: Aug 8, 2024
Reserved: Jul 18, 2024

Description

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-321 Use of Hard-coded Cryptographic Key
CWE-334 Small Space of Random Values
CWE-799 Improper Control of Interaction Frequency

Affected Products

Product	Versions
Journyx (jtime)Journyx	11.5.4Affected

References

https://korelogic.com/Resources/Advisories/KL-001-2024-007.txtthird-party-advisory
http://seclists.org/fulldisclosure/2024/Aug/5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.