CVE-2024-6890 — Journyx Unauthenticated Password Reset Bruteforce

CVE-2024-6890

Journyx Unauthenticated Password Reset Bruteforce PUBLISHED

Description (CNA)

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

Affected (CNA)

Vendor / product	Versions
Journyx / Journyx (jtime)	affected 11.5.4

CWE

CWE-321, CWE-334, CWE-799

References

https://korelogic.com/Resources/Advisories/KL-001-2024-007.txt

ADP enrichment

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2024/Aug/5

CISA-ADP

No English description supplied.

No references supplied.