PT-2022-13751 · Gnuboard5 · Gnuboard5

Published 2022-04-11 · Updated 2024-09-19 · CVE-2022-1252

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions gnuboard/gnuboard5 versions prior to and including 5.5.5

Description The issue concerns the use of a broken or risky cryptographic algorithm, leading to exposure of sensitive information. This allows an attacker to derive the email address of any user, even when the 'Let others see my information.' box is unticked, and to send emails to any email address with full control over the contents.

Recommendations For versions prior to and including 5.5.5, update to a version later than 5.5.5 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2022-1252

Affected Products

Gnuboard5

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1252.json · Exploit
• 🔥 https://0g.vc/posts/insecure-cipher-gnuboard5 · Exploit
• 🔥 https://huntr.dev/bounties/c8c2c3e1-67d0-4a11-a4d4-11af567a9ebb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-1252 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1252 · Vendor Advisory
• https://t.me/cvenotify/28690 · Telegram Post
• https://t.me/cibsecurity/40453 · Telegram Post
• https://t.me/cvenotify/28988 · Telegram Post