critical9.8Public exploit code
CVE-2020-27422
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeove…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover2020-12-02 · webapps · php
Impact
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Anuko | Time Tracker | through 1.19.23.5311 |
Weakness classification
References
- NVD record
- CVE.org record
- https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html
- https://www.anuko.com/time-tracker/index.htm
- https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html
- https://www.anuko.com/time-tracker/index.htm