PT-2008-3049 · Punbb · Punbb

Epibite + 1 · Publicado 2008-03-24 · Atualizado 2018-10-11 · CVE-2008-1484

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PunBB versions 1.2.16 and earlier

Description The password reset feature uses predictable random numbers based on the system time, allowing remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account.

Recommendations For PunBB versions 1.2.16 and earlier, consider disabling the password reset feature until a fix is available to prevent exploitation. Restrict access to the password reset functionality to minimize the risk of brute force attacks.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-1484

Produtos afetados

Punbb

Referências · 10

• 🔥 https://exploit-db.com/exploits/5165 · Exploit
• http://sektioneins.de/advisories/SE-2008-01.txt · Nota
• http://secunia.com/advisories/29043 · Aviso do Fabricante
• http://punbb.org/forums/viewtopic.php?id=18460 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1484 · Nota
• http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt · Nota
• http://securityfocus.com/bid/27908 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-1484 · Nota de Segurança
• http://osvdb.org/45561 · Nota
• http://securityfocus.com/archive/1/488408/100/200/threaded · Nota