TI-2024-06390 CVE-2024-6890 · GHSA-4rc5-7v2h-gq36
Journyx Unauthenticated Password Reset Bruteforce
Priority HIGH 82
Password reset tokens are generated using an insecure source of randomness.
Journyx
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Journyx records in CISA KEVNo Journyx vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2024-06391 CVE-2024-6891 · GHSA-hp2r-hjvj-mq3f
Journyx Authenticated Remote Code Execution
Priority HIGH 73
Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.
TI-2024-06393 CVE-2024-6893 · GHSA-9hxq-vv35-9r5r
Journyx Unauthenticated XML External Entities Injection
Priority HIGH 72
The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities.
TI-2024-06392 CVE-2024-6892 · GHSA-cg3x-qc2c-6jq2
Journyx Reflected Cross Site Scripting
Priority MEDIUM 60
Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.