What is CVE-2021-27200?

CVE-2021-27200 is a critical-severity vulnerability in Wowonder, classified under Use of Insufficiently Random Values. CVSS score: 9.8/10. Published 2021-06-11.

How severe is CVE-2021-27200?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Wowonder

CVE-2021-27200

In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.

EPSS: 0.034 (87.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Wowonder — versions 3.0.4
N/a — versions n/a

Weakness classification (CWE)

CWE-330 — Use of Insufficiently Random Values

References

cve@mitre.org (Product, x_refsource_MISC)
cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-27200?: CVE-2021-27200 is a critical-severity vulnerability in Wowonder, classified under Use of Insufficiently Random Values. CVSS score: 9.8/10. Published 2021-06-11.
How severe is CVE-2021-27200?: Critical severity. CVSS v3 base score is 9.8 out of 10.