CVE-2016-0783: Infoleak
The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0783?
CVE-2016-0783 has been classified with a high severity due to its potential to allow unauthorized password resets.
How do I fix CVE-2016-0783?
To fix CVE-2016-0783, upgrade to Apache OpenMeetings version 3.1.1 or later where this vulnerability has been addressed.
What vulnerabilities are associated with CVE-2016-0783?
CVE-2016-0783 involves predictable password reset tokens that can be exploited by attackers to reset user passwords.
Who is affected by CVE-2016-0783?
All users of Apache OpenMeetings versions prior to 3.1.1 are affected by CVE-2016-0783.
Can CVE-2016-0783 lead to account takeovers?
Yes, CVE-2016-0783 can potentially lead to account takeovers due to the predictable nature of password reset tokens.