Skip to main content

Time Tracker CVE-2020-27423

HIGH
Improper Restriction of Excessive Authentication Attempts (CWE-307)
2020-11-16 cve@mitre.org
Denial Of Service Time Tracker
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 16, 2020 - 16:15 nvd
HIGH 7.5

DescriptionNVD

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox

AnalysisAI

Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-307. Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox Affected products include: Anuko Time Tracker.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Time Tracker

View all
CVE-2022-24707 HIGH POC
8.8 Feb 24

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.8)
CVE-2020-15255 HIGH POC
7.3 Oct 16

In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could
CVE-2023-32308 CRITICAL
9.8 May 15

anuko timetracker is an open source time tracking system. Rated critical severity (CVSS 9.8), this vulnerability is remo
CVE-2023-32306 CRITICAL
9.8 May 12

Time Tracker is an open source time tracking system. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2020-27422 CRITICAL POC
9.8 Nov 16

In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an a
CVE-2021-21352 CRITICAL
9.1 Mar 03

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated critical severity (CVSS

CVE-2021-43851 HIGH
8.8 Dec 22

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.8)
CVE-2021-29436 HIGH
8.1 Apr 13

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated high severity (CVSS 8.1)
CVE-2019-12162 HIGH
7.8 Jul 23

Upwork Time Tracker 5.2.2.716 doesn't verify the SHA256 hash of the downloaded program update before running it, which c
CVE-2021-41139 MEDIUM
6.1 Oct 13

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated medium severity (CVSS 6.
CVE-2023-32066 MEDIUM
5.4 May 09

Time Tracker is an open source time tracking system. Rated medium severity (CVSS 5.4), this vulnerability is remotely ex
CVE-2022-24708 MEDIUM
5.4 Feb 24

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. Rated medium severity (CVSS 5.

Same weakness CWE-307 – Improper Restriction of Excessive Authentication Attempts

View all
CVE-2022-33106 CRITICAL POC
9.8
CVE-2024-43042 CRITICAL POC
9.8
CVE-2024-39225 CRITICAL POC
9.8
CVE-2024-24767 CRITICAL POC
9.8
CVE-2023-6272 CRITICAL POC
9.8
CVE-2023-6756 CRITICAL POC
9.8
CVE-2023-49443 CRITICAL POC
9.8
CVE-2023-48028 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2020-27423 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy