1. Home
  2. CVE Database
  3. CVE-2020-27422
CRITICAL · 9.8

CVE-2020-27422

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.

Vulnerability Description

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AnukoTime Tracker<= 1.19.23.5311

Related Weaknesses (CWE)

CWE-613

References

FAQ

What is CVE-2020-27422?

CVE-2020-27422 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.

How severe is CVE-2020-27422?

CVE-2020-27422 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-27422?

Check the references section above for vendor advisories and patch information. Affected products include: Anuko Time Tracker.