Vulnerability in Oneorzero Helpdesk
CVE-2006-5474
The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset.
EPSS: 0.019 (77.0th percentile) — read the EPSS interpretation.
Affected products
- Oneorzero Oneorzero_helpdesk — versions 1.6, 1.6.3, 1.6.4
- N/a — versions n/a
References
- cve@mitre.org (Exploit, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_BID)