CVE-2008-6971

Опубликовано: 13 авг. 2009

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.

Ссылки

http://osvdb.org/47945
http://secunia.com/advisories/31750
Vendor Advisory
http://www.securityfocus.com/bid/31053
Exploit
http://www.simplemachines.org/community/index.php?topic=260145.0
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44931
https://www.exploit-db.com/exploits/6392
http://osvdb.org/47945
http://secunia.com/advisories/31750
Vendor Advisory
http://www.securityfocus.com/bid/31053
Exploit
http://www.simplemachines.org/community/index.php?topic=260145.0
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44931
https://www.exploit-db.com/exploits/6392

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:simplemachines:smf:1.0.12:*:*:*:*:*:*:*

cpe:2.3:a:simplemachines:smf:1.0.13:*:*:*:*:*:*:*

cpe:2.3:a:simplemachines:smf:1.1.4:*:*:*:*:*:*:*

cpe:2.3:a:simplemachines:smf:1.1.5:*:*:*:*:*:*:*

cpe:2.3:a:simplemachines:smf:2.0:rc1.2:*:*:*:*:*:*

cpe:2.3:a:simplemachines:smf:2.0-beta2:*:*:*:*:*:*:*

cpe:2.3:a:simplemachines:smf:2.0-beta3:*:*:*:*:*:*:*

EPSS

Процентиль: 90%

0.05711

Низкий

7.5 High

CVSS2

Дефекты

CWE-255

Связанные уязвимости

GHSA-875w-x894-8p6c

github

больше 3 лет назад