PT-2020-16327 · Tangro · Tangro Business Workflow

Published 2020-12-18 · Updated 2020-12-21 · CVE-2020-26172

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1

Description The issue allows an attacker to reuse a JWT token when a session is active because every login generates the same JWT token. This token does not contain an expiration timestamp, enabling its reuse.

Recommendations For versions prior to 1.18.1, update to version 1.18.1 or later to resolve the issue. As a temporary workaround, consider implementing a custom expiration mechanism for JWT tokens or restricting session durations to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2020-26172

Affected Products

Tangro Business Workflow

References · 6

• 🔥 https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26172 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26172 · Vendor Advisory
• https://t.me/cvenotify/7493 · Telegram Post
• https://tangro.de · Note
• https://t.me/cibsecurity/21064 · Telegram Post