CVE-2011-0910 The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing at...
MediumCVSS 6.4
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vanillaforums vanilla | <= 2.0.17.5 | No fix listed |
| vanillaforums vanilla | = 2.0.9 | No fix listed |
| vanillaforums vanilla | = 2.0.10 | No fix listed |
| vanillaforums vanilla | = 2.0.11 | No fix listed |
| vanillaforums vanilla | = 2.0.12 | No fix listed |
| vanillaforums vanilla | = 2.0.13 | No fix listed |
| vanillaforums vanilla | = 2.0.14 | No fix listed |
| vanillaforums vanilla | = 2.0.15 | No fix listed |
| vanillaforums vanilla | = 2.0.16 | No fix listed |
| vanillaforums vanilla | = 2.0.17 | No fix listed |
| vanillaforums vanilla | = 2.0.17.1 | No fix listed |
| vanillaforums vanilla | = 2.0.17.2 | No fix listed |
| vanillaforums vanilla | = 2.0.17.3 | No fix listed |
| vanillaforums vanilla | = 2.0.17.4 | No fix listed |