PT-2008-3411 · Blackboard · Blackboard Academic Suite

Duong Thanh + 1 · Publicado 2008-04-18 · Atualizado 2018-10-11 · CVE-2008-1883

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Blackboard Academic Suite versions 7.x

Description The issue allows remote attackers to access accounts more easily by modifying the client to skip the javascript/md5.js hash calculation and send an arbitrary MD5 string instead. This is because the server stores MD5 password hashes provided directly by clients.

Recommendations For Blackboard Academic Suite versions 7.x, consider disabling the direct acceptance of MD5 password hashes from clients as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-1883

Produtos afetados

Blackboard Academic Suite

Referências · 7

• 🔥 http://scribd.com/doc/2363025/Hacking-Blackboard-Academic-Suite · Exploit
• 🔥 http://secskill.wordpress.com/2008/03/27/hacking-blackboard-academic-suite-2 · Exploit
• http://securityreason.com/securityalert/3810 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1883 · Nota de Segurança
• http://securityfocus.com/archive/1/490096/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41935 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1883 · Nota