CVE-2020-27408

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

OpenSIS Community Edition through 7.6 is affected by incorrect access controls for the file ResetUserInfo.php that allow an unauthenticated attacker to change the password of arbitrary users.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287CWE-640

Affected software

No affected versions have been published.

Timeline

Published
Dec 4, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-274096.1OpenSIS Community Edition before 7.5 is affected by a cross-site scripting (XSS) vulnerability in SideForStudent.php via the modname parametCVE-2020-27416.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PriorCVE-2020-274134.2An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password whCVE-2020-274145.9Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to information disclosure if CVE-2020-274169.8Mahavitaran android application 7.50 and prior are affected by account takeover due to improper OTP validation, allows remote attackers to cCVE-2020-274184.4A Use After Free vulnerability in Fedora Linux kernel 5.9.0-rc9 allows attackers to obatin sensitive information via vgacon_invert_region() CVE-2020-27428.2Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PriorCVE-2020-274229.8In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the sCVE-2020-274237.5Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on CVE-2020-274286.1A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTMCVE-2020-27436.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are PriorCVE-2020-27445.4Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Security). Supported versions that are affe
CVE-2020-27408: High severity, CVSS 7.5 | Vulnix