CVE-2008-1484

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-03-24 · updated 2026-06-16
Weakness: CWE-264

Description

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE: this issue might be related to CVE-2006-5737.

Affected products

Punbb: 1.0, 1.0.1, 1.0_alpha, 1.0_beta1, 1.0_beta2, 1.0_beta3 (+25)

References

http://osvdb.org/45561
http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt
http://punbb.org/forums/viewtopic.php?id=18460
http://secunia.com/advisories/29043
http://sektioneins.de/advisories/SE-2008-01.txt
http://www.securityfocus.com/archive/1/488408/100/200/threaded
http://www.securityfocus.com/bid/27908
https://www.exploit-db.com/exploits/5165
http://osvdb.org/45561
http://punbb.org/download/changelogs/1.2.16_to_1.2.17.txt
http://punbb.org/forums/viewtopic.php?id=18460
http://secunia.com/advisories/29043

Get alerted when CVE-2008-1484 or the next vulnerability affects your stack