Vulnerability Database

289,782

Total vulnerabilities in the database

CVE-2008-6971

The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.

  • Published: Aug 13, 2009
  • Updated: Apr 13, 2023
  • CVE: CVE-2008-6971
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
simplemachines / smf 1.0.13 1.0.13.x
simplemachines / smf 1.1.4 1.1.4.x
simplemachines / smf 2.0-beta2 2.0-beta2.x
simplemachines / smf 2.0-beta3 2.0-beta3.x
simplemachines / smf 1.1.5 1.1.5.x
simplemachines / smf 2.0-rc1.2 2.0-rc1.2.x
simplemachines / smf 1.0.12 1.0.12.x