CVE-2008-3681

EUVD-2008-3667
components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the "first enabled user (lowest id)" password, typically for the administrator.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
Affected Products (NVD)
VendorProductVersion
joomlacom_user
1.5
joomlacom_user
1.5.1
joomlacom_user
1.5.2
joomlacom_user
1.5.3
joomlacom_user
1.5.4
joomlacom_user
1.5.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html
http://secunia.com/advisories/31457
http://securityreason.com/securityalert/4157
http://www.securityfocus.com/bid/30667
http://www.securitytracker.com/id?1020687
https://exchange.xforce.ibmcloud.com/vulnerabilities/44430
https://www.exploit-db.com/exploits/6234
http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html
http://secunia.com/advisories/31457
http://securityreason.com/securityalert/4157
http://www.securityfocus.com/bid/30667
http://www.securitytracker.com/id?1020687
https://exchange.xforce.ibmcloud.com/vulnerabilities/44430
https://www.exploit-db.com/exploits/6234