CVE-2020-15906 - tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts

CRITICAL

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts

Published Oct 22, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 27.16%

tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.

No remediation recorded yet.

Weaknesses (1)

CWE-307

Link	Providers	Tags
http://packetstormsecurity.com/files/159663/Tiki-Wiki-CMS-Groupware-21.1-Authentication-Bypass.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7878		Advisory
https://info.tiki.org/article473-Security-Releases-of-all-Tiki-versions-since-16-3		x_refsource_MISCPatchVendor Advisory