[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0808141941030.17005@faron.mitre.org>
Date: Thu, 14 Aug 2008 19:41:16 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: Joomla 1.5.x core.
======================================================
Name: CVE-2008-3681
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3681
Reference: MILW0RM:6234
Reference: URL:http://www.milw0rm.com/exploits/6234
Reference: CONFIRM:http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html
Reference: BID:30667
Reference: URL:http://www.securityfocus.com/bid/30667
Reference: SECTRACK:1020687
Reference: URL:http://www.securitytracker.com/id?1020687
Reference: SECUNIA:31457
Reference: URL:http://secunia.com/advisories/31457
components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does
not properly restrict access, which allows remote attackers to reset
the "first enabled user (lowest id)" password, typically for the
administrator.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
