CVE-2020-28597
03.03.2021, 18:15
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.
| Vendor | Product | Version |
|---|---|---|
| epignosishq | efront | 5.2.17 |
| epignosishq | efront | 5.2.21 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-337 - Predictable Seed in Pseudo-Random Number Generator (PRNG)A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
- CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)The software uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.