PT-2011-2753 · Vanilla · Vanilla Forums

Timvanilla Staff · Published 2011-02-08 · Updated 2020-06-04 · CVE-2011-0910

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Vanilla Forums versions prior to 2.0.17.6

Description The issue makes it easier for remote attackers to spoof signed requests and obtain access to arbitrary user accounts via HMAC timing attacks. This allows attackers to potentially gain unauthorized access to user accounts.

Recommendations For versions prior to 2.0.17.6, update to version 2.0.17.6 or later to resolve the issue.

Fix

Related Identifiers

CVE-2011-0910

Affected Products

Vanilla Forums

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-0910 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0910 · Note
• http://vanillaforums.org/discussion/comment/134729/#Comment_134729 · Note