CVE-2020-28874

EUVD-2020-21265
reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Affected Products (NVD)
VendorProductVersion
projectsendprojectsend
𝑥
< r1295
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://projectsend.com
https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e
https://github.com/projectsend/projectsend/commits/master
https://github.com/projectsend/projectsend/releases/tag/r1295
https://github.com/varandinawer/CVE-2020-28874
http://projectsend.com
https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e
https://github.com/projectsend/projectsend/commits/master
https://github.com/projectsend/projectsend/releases/tag/r1295
https://github.com/varandinawer/CVE-2020-28874