PT-2021-11567 · Epignosis · Epignosis Efrontpro

Published 2021-03-03 · Updated 2022-08-31 · CVE-2020-28597

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Epignosis EfrontPro version 5.2.21

Description: A predictable seed vulnerability exists in the password reset functionality. By predicting the seed, it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset page, supplying the password reset token to reset the password of an account of their choice.

Recommendations: For Epignosis EfrontPro version 5.2.21, consider temporarily disabling the password reset functionality until a patch is available. Restrict access to the password reset page to minimize the risk of exploitation. Avoid using the predictable seed in the password reset token generation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-335

CWE-337

Related Identifiers

CVE-2020-28597

Affected Products

Epignosis Efrontpro

References · 4

• https://osv.dev/vulnerability/CVE-2020-28597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28597 · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1221 · Note
• https://t.me/cvenotify/10822 · Telegram Post