Unscored severity · published Feb 10, 2006
CVE-2006-0633
The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and change the password for an IPB account, possibly involving millions of requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Invision Power Board · Invisionpower
2.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0633
forums.invisionpower.com
http://forums.invisionpower.com/lofiversion/index.php/t200085.html
Patch
http://www.r-security.net/tutorials/view/readtutorial.php?id=4
More from Invision Power Board
–
CVE-2015-6810
Cross-site scripting (XSS) vulnerability in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) 4.x before 4.0.12.1 allows remote…
–
CVE-2014-9239
SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before…
–
CVE-2012-5692
Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors