Vulnerability CVE-2011-4321 - CERT Civis.Net

Vulnerability Name:

CVE-2011-4321 (CCN-71396)

Assigned:

2011-11-14

Published:

2011-11-14

Updated:

2011-11-28

Summary:

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2011-4321

Source: CCN
Type: Joomla Security News 20111103
Core - Password Change

Source: CONFIRM
Type: UNKNOWN
http://developer.joomla.org/security/news/9-security/10-core-security/375-20111103-core-password-change

Source: MLIST
Type: UNKNOWN
[oss-security] 20111120 Re: CVE request: joomla 1.5 before 1.5.25 password change vulnerability

Source: CCN
Type: OSVDB ID: 77094
Joomla! Random Number Generator Weakness Password Manipulation

Source: CCN
Type: BID-50736
Joomla! Password Reset Security Bypass Vulnerability

Source: XF
Type: UNKNOWN
joomla-password-sec-bypass(71396)

Vulnerable Configuration:

Configuration 1:

cpe:/a:joomla:joomla!:1.5.0:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.1:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.2:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.3:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.4:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.5:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.6:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.7:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.8:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.9:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.10:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.11:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.12:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.13:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.14:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.15:-:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.15:rc:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.16:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.17:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.18:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.19:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.20:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.21:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.22:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.23:*:*:*:*:*:*:*

OR cpe:/a:joomla:joomla!:1.5.24:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:joomla:joomla!:1.5.0:*:*:*:*:*:*:*

Denotes that component is vulnerable