In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesnt expire once used, allowing an attacker to use the same link to takeover the account.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Time_tracker | Anuko | * | 1.19.23.5311 (including) |