CVE-2021-27200

In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.36% chance of exploitation in the next 30 days, 89th percentile

Published

2021-06-11

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/49989

Security advisories

• https://securityforeveryone.com/blog/wowonder-0-day-vulnerability-cve-2021-27200
• https://www.wowonder.com

References

• CVE Record
• NVD entry