CyberSecBulletin

Journyx vulnerabilities

We track 2 vulnerabilities in Journyx products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 8, 2024.

2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score

Latest Journyx vulnerabilities

  • 7.5 High severity

    Journyx (jtime): Improper Restriction of XML External Entity Reference

    CVE-2024-6893JournyxEPSS 32.9%

    The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

  • 8.8 High severity

    Journyx (jtime): Use of Hard-coded Credentials

    CVE-2024-6890Journyx

    Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user can bruteforce the password reset and change the administrator password.