Predictable Seed Vulnerability in Epignosis EfrontPro 5.2.21 Password Reset Functionality

CVE-2020-28597 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.

Learn more about our Web Application Penetration Testing UK.