Lucene search
HistoryOct 24, 2006 - 8:07 p.m.
CVE-2006-5474
cve-2006-5474
oneorzero helpdesk
password reset
security vulnerability
insecure password
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.5 High
AI Score
Confidence
Low
0.024 Low
EPSS
Percentile
89.9%
The “forgot password” function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset.
Affected configurations
Node
oneorzerooneorzero_helpdeskRange≤1.6.5.3
ORoneorzerooneorzero_helpdeskMatch1.6
ORoneorzerooneorzero_helpdeskMatch1.6.3
ORoneorzerooneorzero_helpdeskMatch1.6.4
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.5 High
AI Score
Confidence
Low
0.024 Low
EPSS
Percentile
89.9%
Related for CVE-2006-5474