Vulnerability Details CVE-2020-28597
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 58.2%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
References
Products affected by CVE-2020-28597
-
cpe:2.3:a:epignosishq:efront:5.2.17
-
cpe:2.3:a:epignosishq:efront:5.2.21