CVE-2018-11209 Weak cryptography in n/a

High 7.2 Published 16 May 2018 Updated 5 Aug 2024

Z-BlogPHP uses MD5 for password verification, allowing attackers to bypass access restrictions via dictionary or rainbow-table attacks.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-11209?

CVE-2018-11209 is a high-severity vulnerability in n/a, published on 16 May 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid issue

Weakness: CWE-327

Which versions are affected by CVE-2018-11209?

It affects 1 product.

Products include Zblogcn Z-Blogphp.

How do I fix CVE-2018-11209?

No fix has been published for CVE-2018-11209 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-11209 being exploited?

There is no known exploitation of CVE-2018-11209 in the wild and no public exploit code.

Sources

Also known as GHSA-hvj4-mm2p-82f7.