CVE-2006-0633: Medium severity Invisionpower Invision Power Board vulnerability

Published Feb 10, 2006

Updated

The makepassword function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and change the password for an IPB account, possibly involving millions of requests.

Affected Software

1 affected component

Invisionpower Invision Power Board=2.1.4

Remediation

Patch Available

http://www.r-security.net/tutorials/view/readtutorial.php?id=4

Event History

Feb 10, 2006

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0633?

CVE-2006-0633 is classified as a medium severity vulnerability due to its potential for password guessing.

How do I fix CVE-2006-0633?

To fix CVE-2006-0633, update to a later version of Invision Power Board that addresses this vulnerability.

What systems are affected by CVE-2006-0633?

CVE-2006-0633 affects Invision Power Board version 2.1.4.

What can attackers do exploit CVE-2006-0633?

Attackers can exploit CVE-2006-0633 to potentially guess authentication codes sent via email for password resets.

Is CVE-2006-0633 still a concern today?

While CVE-2006-0633 is an older vulnerability, its impact remains relevant for systems still using the affected software version.