VulnerabilityModified

CVE-2008-7050

HIGH 7.5EPSS 1.88%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 1.88% probability · 78th percentile
CISA KEV: Not listed
Weakness: CWE-255
Affected: wowraidmanager/wowraidmanager
Source: cve@mitre.org

References

http://github.com/Illydth/wowraidmanager/commit/7dd6367ae85003dd5d715431b6ab695f2c2f200aExploit
http://secunia.com/advisories/32653Vendor Advisory
http://www.osvdb.org/49704
http://www.vupen.com/english/advisories/2008/3109Patch, Vendor Advisory
http://www.wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2153Vendor Advisory
http://www.wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2167Patch, Vendor Advisory
http://github.com/Illydth/wowraidmanager/commit/7dd6367ae85003dd5d715431b6ab695f2c2f200aExploit
http://secunia.com/advisories/32653Vendor Advisory
http://www.osvdb.org/49704
http://www.vupen.com/english/advisories/2008/3109Patch, Vendor Advisory
http://www.wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2153Vendor Advisory
http://www.wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2167Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.