PT-2008-3539 · Simple Machines · Simple Machines Forum

Jessica Hope · Publicado 2008-04-30 · Atualizado 2018-10-11 · CVE-2008-2019

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) version 1.1.4

Description The issue allows remote attackers to bypass the CAPTCHA test through an automated attack, considering Hamming distances, due to the reliance on "randomly generated static" to prevent brute-force attacks on the WAV file (audio) CAPTCHA.

Recommendations For Simple Machines Forum (SMF) version 1.1.4, consider implementing additional security measures to strengthen the CAPTCHA system, such as enhancing the randomness of the static generation or using alternative CAPTCHA methods. As a temporary workaround, restrict access to sensitive areas of the forum that rely on the CAPTCHA test to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-2019

Produtos afetados

Simple Machines Forum

Referências · 9

• 🔥 https://github.com/TheRook/AudioCaptchaBypass-CVE-2008-2019 · Exploit
• http://securityreason.com/securityalert/3836 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42150 · Nota
• http://simplemachines.org/community/index.php?P=c3696c2022b54fa50c5f341bf5710aa3&topic=236816.0 · Nota
• http://rooksecurity.com/blog/?p=6 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2019 · Nota
• http://securityfocus.com/archive/1/491128/100/0/threaded · Nota
• http://securityfocus.com/bid/28866 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2019 · Nota de Segurança