CVE-2006-5737 Weak cryptography in n/a
Predictable cookie seeds allow attackers to forge admin sessions and take over accounts in PunBB forums.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-5737?
CVE-2006-5737 is a high-severity vulnerability in n/a, published on 6 Nov 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PunBB uses a predictable cookie_seed value that can be derived from the time of registration of the superadmin account (installation time), which might allow local users to perform unauthorized actions.
Which versions are affected by CVE-2006-5737?
It affects 1 product.
Products include Punbb Punbb.
How do I fix CVE-2006-5737?
No fix has been published for CVE-2006-5737 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-5737 being exploited?
There is no known exploitation of CVE-2006-5737 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9fgm-w9px-m6vp.