PT-2008-3049 · Punbb · Punbb

Epibite + 1 · Published 2008-03-24 · Updated 2018-10-11 · CVE-2008-1484

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PunBB versions 1.2.16 and earlier

Description The password reset feature uses predictable random numbers based on the system time, allowing remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account.

Recommendations For PunBB versions 1.2.16 and earlier, consider disabling the password reset feature until a fix is available to prevent exploitation. Restrict access to the password reset functionality to minimize the risk of brute force attacks.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1484

Affected Products

Punbb

References · 10

• 🔥 https://exploit-db.com/exploits/5165 · Exploit
• http://secunia.com/advisories/29043 · Vendor Advisory
• http://securityfocus.com/bid/27908 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-1484 · Security Note
• http://sektioneins.de/advisories/SE-2008-01.txt · Note
• http://punbb.org/forums/viewtopic.php?id=18460 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1484 · Note
• http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt · Note
• http://osvdb.org/45561 · Note
• http://securityfocus.com/archive/1/488408/100/200/threaded · Note