CVE-2024-6890

8.8 highEPSS 0.7%

High (8.8) in journyx journyx. EPSS 0.7% chance of exploitation in the next 30 days.

Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWEs: CWE-798, CWE-321, CWE-334, CWE-799
Published: 2024-08-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

journyx:journyx

References

https://korelogic.com/Resources/Advisories/KL-001-2024-007.txt
http://seclists.org/fulldisclosure/2024/Aug/5

Check your stack JSON