PT-2020-7061 · Pforum · Pforum

Henri Salo · Published 2020-01-15 · Updated 2020-01-23 · CVE-2009-5025

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PyForum version 1.0.3

Description A backdoor was found in PyForum where an attacker who knows a valid user email could force a password reset on behalf of that user.

Recommendations For PyForum version 1.0.3, consider disabling the password reset feature until a patch is available to prevent exploitation. Restrict access to the password reset module to minimize the risk of unauthorized password resets. Avoid using the email address as a means of authentication in the affected password reset functionality until the issue is resolved.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2009-5025

Affected Products

Pforum

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2009-5025 · Security Note
• https://seclists.org/fulldisclosure/2009/Nov/353 · Note
• https://packetstormsecurity.com/files/cve/CVE-2009-5025 · Note
• https://t.me/cibsecurity/9231 · Telegram Post
• https://openwall.com/lists/oss-security/2011/07/26/7 · Note