Description

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.

Remediation

References

CVE-2011-0910

Related Vulnerabilities

WordPress Plugin Events Manager Extended Multiple HTML Injection Vulnerabilities (3.1.2)

WordPress Plugin IgniteUp-Coming Soon and Maintenance Mode Multiple Vulnerabilities (3.4)

Drupal Improper Input Validation Vulnerability (CVE-2022-25271)

WordPress Cryptographic Issues Vulnerability (CVE-2014-9037)

Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-34265)

Severity

Medium

Classification

CVE-2011-0910

Tags

Missing Update Known Vulnerabilities