CVE-2004-0294: Medium severity Yabbforumsoftware Yet Another Bulletin Board vulnerability

Published Mar 18, 2004

Updated

YaBB 1 SP 1.3.1 displays different error messages when a user exists or not, which makes it easier for remote attackers to identify valid users and conduct a brute force password guessing attack.

Affected Software

2 affected components

Yabbforumsoftware Yet Another Bulletin Board=1.0-sp1.3.1

Yabb Yabb=1_gold_-_sp_1.3.1

Event History

Mar 18, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0294?

CVE-2004-0294 is considered a medium severity vulnerability as it allows attackers to identify valid usernames for brute force attacks.

How do I fix CVE-2004-0294?

To fix CVE-2004-0294, update to a version of YaBB that does not disclose differing error messages based on valid users.

What systems are affected by CVE-2004-0294?

CVE-2004-0294 affects YaBB versions 1 Gold - SP 1.3.1 and Yet Another Bulletin Board version 1.0 - SP 1.3.1.

What type of attack can CVE-2004-0294 facilitate?

CVE-2004-0294 can facilitate brute force password guessing attacks due to its ability to reveal valid usernames.

Is CVE-2004-0294 still relevant today?

While CVE-2004-0294 is an older vulnerability, systems still using the affected versions remain at risk.