CVE-2008-1484
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate…
Does this matter?
Lower severity and a low EPSS score (4.52%). Track it; it rarely justifies an emergency change on its own.
Description
The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.
- CVSS 2.0
- 3.5 LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
- EPSS
- 4.52% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- punbb/punbb
- Source
- cve@mitre.org
References
- http://osvdb.org/45561
- http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt
- http://punbb.org/forums/viewtopic.php?id=18460
- http://secunia.com/advisories/29043Vendor Advisory
- http://sektioneins.de/advisories/SE-2008-01.txt
- http://www.securityfocus.com/archive/1/488408/100/200/threaded
- http://www.securityfocus.com/bid/27908Patch
- https://www.exploit-db.com/exploits/5165
- http://osvdb.org/45561
- http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt
- http://punbb.org/forums/viewtopic.php?id=18460
- http://secunia.com/advisories/29043Vendor Advisory
- http://sektioneins.de/advisories/SE-2008-01.txt
- http://www.securityfocus.com/archive/1/488408/100/200/threaded
- http://www.securityfocus.com/bid/27908Patch
- https://www.exploit-db.com/exploits/5165
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.