#VU51235 Improper Authentication in eFront - CVE-2020-28597

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU51235

#VU51235 Improper Authentication in eFront - CVE-2020-28597

Published: March 4, 2021


Vulnerability identifier: #VU51235
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2020-28597
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
eFront
Software vendor:
Epignosis LLC

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to a predictable seed issue in the password reset functionality. A remote attacker can supply the password reset token and reset the password of an account of their choice.


Remediation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External links