CVE-2008-6971

The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
VendorProductVersion
simplemachinessmf
1.0.12
simplemachinessmf
1.0.13
simplemachinessmf
1.1.4
simplemachinessmf
1.1.5
simplemachinessmf
2.0:rc1.2
simplemachinessmf
2.0-beta2
simplemachinessmf
2.0-beta3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/47945
http://secunia.com/advisories/31750
http://www.securityfocus.com/bid/31053
http://www.simplemachines.org/community/index.php?topic=260145.0
https://exchange.xforce.ibmcloud.com/vulnerabilities/44931
https://www.exploit-db.com/exploits/6392
http://osvdb.org/47945
http://secunia.com/advisories/31750
http://www.securityfocus.com/bid/31053
http://www.simplemachines.org/community/index.php?topic=260145.0
https://exchange.xforce.ibmcloud.com/vulnerabilities/44931
https://www.exploit-db.com/exploits/6392