CVE-2024-6890

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p52

Published

Aug 7, 2024 (Aug 7, 2024)

Modified

Jun 17, 2026

Description

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

Vendors: journyx
Products: journyx
Weakness: CWE-321, CWE-334, CWE-799, CWE-798
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.