PT-2006-4656 · Deluxebb · Deluxebb

Jessica Hope + 1 · Published 2006-07-21 · Updated 2018-10-17 · CVE-2006-3796

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeluxeBB versions 1.07 and earlier

Description The issue arises from improper handling of a username consisting of a single space character. This allows remote authenticated users to login as the "space" user, post as the guest user, and prevent an administrator from banning the "space" user.

Recommendations For DeluxeBB versions 1.07 and earlier, update to a version that properly handles usernames to prevent exploitation.

Fix

Related Identifiers

CVE-2006-3796

Affected Products

Deluxebb

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-3796 · Security Note
• http://securityfocus.com/archive/1/440435/100/0/threaded · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047989.html · Note
• http://securityfocus.com/bid/19052 · Note
• http://securityreason.com/securityalert/1254 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3796 · Note