CVE-2020-28597

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221	Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:epignosishq:efront:5.2.17::::pro:::
	cpe:2.3:a:epignosishq:efront:5.2.21::::pro:::

History

21 Nov 2024, 05:22

Type	Values Removed	Values Added
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221 - Third Party Advisory~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221 - Third Party Advisory

Information

Published : 2021-03-03 18:15

Updated : 2024-11-21 05:22

NVD link : CVE-2020-28597

Mitre link : CVE-2020-28597

CVE.ORG link : CVE-2020-28597

JSON object : View

Products Affected

epignosishq

efront

CWE

CWE-337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

CWE-335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2020-28597", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-03-03T18:15:13.720", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221", "tags": ["Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-337"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-335"}]}], "descriptions": [{"lang": "en", "value": "A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de seed predecible en la funcionalidad password reset de Epignosis EfrontPro versi\u00f3n 5.2.21. Al predecir el seed, es posible generar el token de restablecimiento de contrase\u00f1a correcto 1 vez. Un atacante puede visitar el restablecimiento de contrase\u00f1a proporcionando el token de restablecimiento de contrase\u00f1a para restablecer la contrase\u00f1a de una cuenta de su elecci\u00f3n"}], "lastModified": "2024-11-21T05:22:58.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:epignosishq:efront:5.2.17:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "9785C4D1-6022-40FF-94F9-F1F190AF2DE7"}, {"criteria": "cpe:2.3:a:epignosishq:efront:5.2.21:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "57C3D6B8-7A6A-4E4E-B8C7-D1C26A8D6254"}], "operator": "OR"}]}], "sourceIdentifier": "talos-cna@cisco.com"}