CVE-2011-2082 Weak cryptography in n/a

Medium 5.0 Published 4 Jun 2012 Updated 6 Aug 2024

Attackers can brute-force disabled user passwords due to weak hashing, potentially gaining access if accounts are re-enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-2082?

CVE-2011-2082 is a medium-severity vulnerability in n/a, published on 4 Jun 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use these passwords after accounts are re-enabled, via a brute-force attack on the database. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0009.

Weakness: CWE-255

Which versions are affected by CVE-2011-2082?

It affects 1 product.

Products include Bestpractical Rt.

How do I fix CVE-2011-2082?

Upgrade to a fixed version.

Is CVE-2011-2082 being exploited?

There is no known exploitation of CVE-2011-2082 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2011-2082, GHSA-pxc3-v4rj-fc78.