CVE-2008-6957: High severity discuz! vulnerability

Published Aug 12, 2009

Updated

member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpasswd actions, possibly involving predictable generation of the id parameter.

Affected Software

1 affected component

Discuz Discuz\!

Event History

Aug 12, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-6957?

CVE-2008-6957 has been categorized as a medium severity vulnerability.

How do I fix CVE-2008-6957?

To fix CVE-2008-6957, ensure that your Discuz! installation is updated to the latest version which addresses this vulnerability.

What types of attacks are possible with CVE-2008-6957?

CVE-2008-6957 allows remote attackers to reset passwords of arbitrary users through crafted lostpasswd and getpasswd actions.

Which versions of Discuz! are affected by CVE-2008-6957?

CVE-2008-6957 affects certain versions of Discuz! prior to the security patch release that mitigates this issue.

What is the primary impact of CVE-2008-6957?

The primary impact of CVE-2008-6957 is unauthorized password resets, potentially compromising user accounts on affected Discuz! boards.