B2Evolution CVE-2016-9479

HIGH

Credentials Management Errors (CWE-255)

2016-12-02 cve@mitre.org

Authentication Bypass B2Evolution

7.5

CVSS 3.0 · NVD

Share

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

1

CVE Published

Dec 02, 2016 - 16:59 cve.org

HIGH 7.5

DescriptionCVE.org

The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.

AnalysisAI

The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-255. The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request. Affected products include: B2Evolution. Version information: before 6.7.9.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in B2Evolution

View all

CVE-2021-31632 CRITICAL Act Now POC

b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the Use

CVE-2021-31631 HIGH This Week POC

b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. Rated high

CVE-2021-28242 HIGH This Week POC

SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive dat

CVE-2013-7352 MEDIUM This Month POC

Cross-site request forgery (CSRF) vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote attackers t

CVE-2013-2945 MEDIUM This Month POC

SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to

CVE-2017-5539 CRITICAL Act Now

The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. Rated

CVE-2022-30935 CRITICAL Act Now

An authorization bypass in b2evolution allows remote, unauthenticated attackers to predict password reset tokens for any

CVE-2014-9599 MEDIUM This Month POC

Cross-site scripting (XSS) vulnerability in the filemanager in b2evolution before 5.2.1 allows remote attackers to injec

CVE-2012-5911 MEDIUM This Month POC

Cross-site scripting (XSS) vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbit

CVE-2017-5480 HIGH This Week

Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated u

CVE-2012-5910 MEDIUM This Month

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execut

CVE-2016-7149 MEDIUM This Month

Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary we

Same weakness CWE-255 – Credentials Management Errors

View all

CVE-2014-1812 HIGH POC

CVE-2016-7456 CRITICAL POC

CVE-2012-1493 HIGH POC

CVE-2012-4933 HIGH POC

CVE-2013-4786 HIGH POC

CVE-2013-3502 MEDIUM POC

CVE-2015-7251 CRITICAL POC

CVE-2013-6884 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

CVE-2016-9479 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy