CVE-2006-0632: Medium severity Phpbb Group Phpbb vulnerability
The genrandstring function in phpBB 2.0.19 uses insufficiently random data (small value space) to create the activation key ("validation ID") that is sent by e-mail when establishing a password, which makes it easier for remote attackers to obtain the key and modify passwords for existing accounts or create new accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0632?
The severity of CVE-2006-0632 is considered to be medium risk due to the potential for unauthorized password resets.
How do I fix CVE-2006-0632?
To fix CVE-2006-0632, upgrade phpBB to version 2.0.20 or later, which addresses the insufficient randomness issue.
What versions of phpBB are affected by CVE-2006-0632?
CVE-2006-0632 affects phpBB versions 2.0.1 through 2.0.19.
What type of vulnerability is CVE-2006-0632?
CVE-2006-0632 is a security vulnerability that involves weak random number generation used in password activation keys.
Who can exploit CVE-2006-0632?
Remote attackers can exploit CVE-2006-0632 to compromise existing user accounts by predicting the activation key.