CVE-2002-1846: Medium severity Yabb Yabb vulnerability

Published Dec 31, 2002

Updated

Yet Another Bulletin Board (YaBB) 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by stealing the cookie of another user, modifying the expiretime setting, and submitting the change in a profile2 action to index.php.

Affected Software

2 affected components

Yabb Yabb=1.40

Yabb Yabb=1.41

Event History

Dec 31, 2002

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

DescriptionSeverityAffected Software

Jun 28, 2005

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-1846?

CVE-2002-1846 is considered a moderate severity vulnerability due to its potential for unauthorized password changes.

How do I fix CVE-2002-1846?

To fix CVE-2002-1846, upgrade YaBB to version 1.42 or later which addresses this vulnerability.

What systems are affected by CVE-2002-1846?

CVE-2002-1846 affects YaBB versions 1.40 and 1.41.

What type of attack is facilitated by CVE-2002-1846?

CVE-2002-1846 enables attackers to modify user passwords by exploiting cookie theft.

Is there a workaround for CVE-2002-1846?

A temporary workaround for CVE-2002-1846 is to implement stricter cookie management and password change requirements until a proper update can be applied.