Description

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.

Remediation

References

CVE-2011-0910

Related Vulnerabilities

WordPress Plugin WP Statistics SQL Injection (13.1.4)

Vanilla Forums Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-16410)

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-4112)

WordPress Plugin Easy Digital Downloads-Recent Purchases Remote File Inclusion (1.0.2)

Oracle Application Server Other Vulnerability (CVE-2002-0566)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CVE-2011-0910