CVEvulnerability
CVE-2008-3681
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-08-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the "first enabled user (lowest id)" password, typically for the administrator.
Affected configurations
• joomla com user 1.5
• joomla com user 1.5.1
• joomla com user 1.5.2
• joomla com user 1.5.3
• joomla com user 1.5.4
• joomla com user 1.5.5
Related
Weakness · not in database (1)
References
- http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html developer.joomla.org
- http://secunia.com/advisories/31457 Vendor Advisory
- http://securityreason.com/securityalert/4157 securityreason.com
- http://www.securityfocus.com/bid/30667 www.securityfocus.com
- http://www.securitytracker.com/id?1020687 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44430 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6234 www.exploit-db.com
- http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html developer.joomla.org
- http://secunia.com/advisories/31457 Vendor Advisory
- http://securityreason.com/securityalert/4157 securityreason.com
- http://www.securityfocus.com/bid/30667 www.securityfocus.com
- http://www.securitytracker.com/id?1020687 www.securitytracker.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44430 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6234 www.exploit-db.com