CVE-2008-3681

2008-08-1419:41:00

CWE-264

mitre

web.nvd.nist.gov

joomla

vulnerability

remote attack

password reset

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.099

Percentile

94.9%

JSON

components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the “first enabled user (lowest id)” password, typically for the administrator.

Affected configurations

Nvd

Node

joomlacom_userMatch1.5

joomlacom_userMatch1.5.1

joomlacom_userMatch1.5.2

joomlacom_userMatch1.5.3

joomlacom_userMatch1.5.4

joomlacom_userMatch1.5.5

VendorProductVersionCPE
joomlacom_user1.5cpe:2.3:a:joomla:com_user:1.5:*:*:*:*:*:*:*
joomlacom_user1.5.1cpe:2.3:a:joomla:com_user:1.5.1:*:*:*:*:*:*:*
joomlacom_user1.5.2cpe:2.3:a:joomla:com_user:1.5.2:*:*:*:*:*:*:*
joomlacom_user1.5.3cpe:2.3:a:joomla:com_user:1.5.3:*:*:*:*:*:*:*
joomlacom_user1.5.4cpe:2.3:a:joomla:com_user:1.5.4:*:*:*:*:*:*:*
joomlacom_user1.5.5cpe:2.3:a:joomla:com_user:1.5.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
joomla	com_user	1.5	cpe:2.3:a:joomla:com_user:1.5:::::::*
joomla	com_user	1.5.1	cpe:2.3:a:joomla:com_user:1.5.1:::::::*
joomla	com_user	1.5.2	cpe:2.3:a:joomla:com_user:1.5.2:::::::*
joomla	com_user	1.5.3	cpe:2.3:a:joomla:com_user:1.5.3:::::::*
joomla	com_user	1.5.4	cpe:2.3:a:joomla:com_user:1.5.4:::::::*
joomla	com_user	1.5.5	cpe:2.3:a:joomla:com_user:1.5.5:::::::*