CVE-2016-2564: Medium severity invision community vulnerability
Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2564?
CVE-2016-2564 has been classified as a medium severity vulnerability due to its potential for session hijacking.
How do I fix CVE-2016-2564?
To fix CVE-2016-2564, upgrade your Invision Power Board to version 4.1.9 or later where the vulnerability has been addressed.
What type of attack does CVE-2016-2564 enable?
CVE-2016-2564 enables session hijacking by allowing attackers to predict and guess session cookies.
Which versions of Invision Power Board are affected by CVE-2016-2564?
CVE-2016-2564 affects all versions of Invision Power Board before 4.1.9.
What is the cause of CVE-2016-2564?
CVE-2016-2564 is caused by the use of the PHP uniqid function without the more_entropy flag, making session cookie generation predictable.