Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing the victim's 2FA protections.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Warning: High authentication vulnerability in #EspoCRM. CVE-2020-37094 CVSS: 8.7. This vulnerability can allow attackers to access other user accounts #Patch #Patch #Patch
Post summary
The post alerts that a high‑severity authentication flaw (CVE‑2020‑37094) in EspoCRM enables attackers to impersonate other user accounts and indicates that a patch is available.
CVE-2020-37094 EspoCRM 5.8.5 contains an authentication vulnerability that allows attackers to access other user accounts by manipulating authorization headers. Attackers can decode… https://www.cve.org/CVERecord?id=CVE-2020-37094
Post summary
The post announces CVE-2020-37094, an authentication vulnerability in EspoCRM 5.8.5 that lets attackers gain access to other accounts by tampering with authorization headers.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | espocrm | espocrm | - | - | - |