PT-2020-16687 · Anuko · Anuko Time Tracker

Published 2020-11-16 · Updated 2020-11-30 · CVE-2020-27422

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anuko Time Tracker version 1.19.23.5311

Description The password reset link emailed to the user does not expire once used, allowing an attacker to use the same link to take over the account.

Recommendations For Anuko Time Tracker version 1.19.23.5311, consider implementing a mechanism to expire the password reset link after its first use to prevent account takeover. As a temporary workaround, restrict access to password reset functionality until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-27422

Affected Products

Anuko Time Tracker

References · 7

• 🔥 https://exploit-db.com/exploits/49174 · Exploit
• https://anuko.com/time-tracker/index.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27422 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27422 · Vendor Advisory
• https://t.me/cibsecurity/16348 · Telegram Post
• https://t.me/cvenotify/5631 · Telegram Post
• https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html · Note