PT-2008-3411 · Blackboard · Blackboard Academic Suite

Duong Thanh + 1 · Published 2008-04-18 · Updated 2018-10-11 · CVE-2008-1883

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Blackboard Academic Suite versions 7.x

Description The issue allows remote attackers to access accounts more easily by modifying the client to skip the javascript/md5.js hash calculation and send an arbitrary MD5 string instead. This is because the server stores MD5 password hashes provided directly by clients.

Recommendations For Blackboard Academic Suite versions 7.x, consider disabling the direct acceptance of MD5 password hashes from clients as a temporary workaround until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-1883

Affected Products

Blackboard Academic Suite

References · 7

• 🔥 http://scribd.com/doc/2363025/Hacking-Blackboard-Academic-Suite · Exploit
• 🔥 http://secskill.wordpress.com/2008/03/27/hacking-blackboard-academic-suite-2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1883 · Security Note
• http://securityreason.com/securityalert/3810 · Note
• http://securityfocus.com/archive/1/490096/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41935 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1883 · Note