A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.
Weakness
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Efront | Epignosishq | 5.2.17 (including) | 5.2.17 (including) |
| Efront | Epignosishq | 5.2.21 (including) | 5.2.21 (including) |