CVE-2002-0226 | BDVDB-2026-4418 Detail

Description#

retrieve_password.pl in DCForum 6.x and 2000 generates predictable new passwords based on a sessionID, which allows remote attackers to request a new password on behalf of another user and use the sessionID to calculate the new password for that user.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.osvdb.org/3866
http://marc.info/?l=bugtraq&m=101258311519504&w=2
http://www.iss.net/security_center/static/8044.php
http://www.dcscripts.com/bugtrac/DCForumID7/3.html
http://www.osvdb.org/2038
http://www.securityfocus.com/bid/4014

Exploit#

No public exploit known

History#

Version 12002-06-25Record published in the CVE List.
Version 22024-08-08Most recent update recorded in the CVE List.