CVE-2018-16988 - An issue was discovered in Open XDMoD through 7.5.0

Back Back to CVE browser

CRITICAL

An issue was discovered in Open XDMoD through 7.5.0

Published May 2, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 1.62%

Description

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a password-reset process (pass_reset.php, password_reset.php, XDUser.php) in the past few minutes.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-640

References (1)

https://github.com/grymer/CVE/blob/master/CVE-2018-16988.md
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://github.com/grymer/CVE/blob/master/CVE-2018-16988.md		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 2, 2019

Updated Aug 5, 2024

Reserved Sep 13, 2018

Link CVE-2018-16988

CISA Vulnrichment

Updated n/a

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2018-16988

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-16988