Skip to main content

Time Tracker CVE-2020-27422

CRITICAL
Insufficient Session Expiration (CWE-613)
2020-11-16 cve@mitre.org
Information Disclosure Time Tracker
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 16, 2020 - 16:15 nvd
CRITICAL 9.8

DescriptionNVD

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.

AnalysisAI

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-613. In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account. Affected products include: Anuko Time Tracker.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Time Tracker

View all
CVE-2022-24707 HIGH POC
8.8 Feb 24

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.8)
CVE-2020-15255 HIGH POC
7.3 Oct 16

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could
CVE-2023-32308 CRITICAL
9.8 May 15

anuko timetracker is an open source time tracking system. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2023-32306 CRITICAL
9.8 May 12

Time Tracker is an open source time tracking system. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2021-21352 CRITICAL
9.1 Mar 03

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated critical severity (CVSS

CVE-2021-43851 HIGH
8.8 Dec 22

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.8)
CVE-2021-29436 HIGH
8.1 Apr 13

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.1)
CVE-2019-12162 HIGH
7.8 Jul 23

Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which c
CVE-2020-27423 HIGH POC
7.5 Nov 16

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial o
CVE-2021-41139 MEDIUM
6.1 Oct 13

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated medium severity (CVSS 6.
CVE-2023-32066 MEDIUM
5.4 May 09

Time Tracker is an open source time tracking system. Rated medium severity (CVSS 5.4), this vulnerability is remotely ex
CVE-2022-24708 MEDIUM
5.4 Feb 24

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated medium severity (CVSS 5.

Same weakness CWE-613 – Insufficient Session Expiration

View all
CVE-2022-36179 CRITICAL POC
9.8
CVE-2026-26342 CRITICAL POC
9.8
CVE-2016-5069 CRITICAL POC
9.8
CVE-2024-29401 CRITICAL POC
9.8
CVE-2023-49091 CRITICAL POC
9.8
CVE-2023-5865 CRITICAL POC
9.8
CVE-2023-5838 CRITICAL POC
9.8
CVE-2023-1854 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2020-27422 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy