Lucene search

MitreCVE-2008-7050

HistoryAug 24, 2009 - 10:30 a.m.

CVE-2008-7050

2009-08-2410:30:02

CWE-255

mitre

web.nvd.nist.gov

cve-2008-7050

phpbb3 authentication

authentication bypass

remote attackers

nvd

wow raid manager 3.5.1

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

Low

EPSS

0.024

Percentile

90.2%

JSON

The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.

Affected configurations

Nvd

Node

wowraidmanagerwowraidmanagerRange≤3.5.1

wowraidmanagerwowraidmanagerMatch3.1.0

wowraidmanagerwowraidmanagerMatch3.1.1

wowraidmanagerwowraidmanagerMatch3.1.2

wowraidmanagerwowraidmanagerMatch3.2.0

wowraidmanagerwowraidmanagerMatch3.2.1

wowraidmanagerwowraidmanagerMatch3.5.0

VendorProductVersionCPE
wowraidmanagerwowraidmanager*cpe:2.3:a:wowraidmanager:wowraidmanager:*:*:*:*:*:*:*:*
wowraidmanagerwowraidmanager3.1.0cpe:2.3:a:wowraidmanager:wowraidmanager:3.1.0:*:*:*:*:*:*:*
wowraidmanagerwowraidmanager3.1.1cpe:2.3:a:wowraidmanager:wowraidmanager:3.1.1:*:*:*:*:*:*:*
wowraidmanagerwowraidmanager3.1.2cpe:2.3:a:wowraidmanager:wowraidmanager:3.1.2:*:*:*:*:*:*:*
wowraidmanagerwowraidmanager3.2.0cpe:2.3:a:wowraidmanager:wowraidmanager:3.2.0:*:*:*:*:*:*:*
wowraidmanagerwowraidmanager3.2.1cpe:2.3:a:wowraidmanager:wowraidmanager:3.2.1:*:*:*:*:*:*:*
wowraidmanagerwowraidmanager3.5.0cpe:2.3:a:wowraidmanager:wowraidmanager:3.5.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wowraidmanager	wowraidmanager	*	cpe:2.3:a:wowraidmanager:wowraidmanager::::::::
wowraidmanager	wowraidmanager	3.1.0	cpe:2.3:a:wowraidmanager:wowraidmanager:3.1.0:::::::*
wowraidmanager	wowraidmanager	3.1.1	cpe:2.3:a:wowraidmanager:wowraidmanager:3.1.1:::::::*
wowraidmanager	wowraidmanager	3.1.2	cpe:2.3:a:wowraidmanager:wowraidmanager:3.1.2:::::::*
wowraidmanager	wowraidmanager	3.2.0	cpe:2.3:a:wowraidmanager:wowraidmanager:3.2.0:::::::*
wowraidmanager	wowraidmanager	3.2.1	cpe:2.3:a:wowraidmanager:wowraidmanager:3.2.1:::::::*
wowraidmanager	wowraidmanager	3.5.0	cpe:2.3:a:wowraidmanager:wowraidmanager:3.5.0:::::::*

References

github.com/Illydth/wowraidmanager/commit/7dd6367ae85003dd5d715431b6ab695f2c2f200a

secunia.com/advisories/32653

www.osvdb.org/49704

www.vupen.com/english/advisories/2008/3109

www.wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2153

www.wowraidmanager.net/e107_plugins/forum/forum_viewtopic.php?2167

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

Low

EPSS

0.024

Percentile

90.2%

JSON

Related for CVE-2008-7050