Vulnerability in Simple Machines Smf
CVE-2008-2019
Simple Machines Forum (SMF), probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file (aka audio) CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated attack that considers Hamming distances. NOTE: this issue reportedly exists because of an insufficient fix for CVE-2007-3308.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.041 (90.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 90.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.041 · newest: 0.041 · change: 0.000
Affected products
- Simple Machines Smf — versions 1.1.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- exchange.xforce.ibmcloud.com/vulnerabilities/42150 (vdb-entry)
- securityreason.com/securityalert/3836 (third-party-advisory)
- www.securityfocus.com/bid/28866 (vdb-entry)
- www.securityfocus.com/archive/1/491128/100/0/threaded (mailing-list)
- www.rooksecurity.com/blog/
- www.simplemachines.org/community/index.php
Frequently asked questions
- What is CVE-2008-2019?
- CVE-2008-2019 is a vulnerability in Simple Machines Smf, classified under CWE-264. Published 2008-04-30.
- Is CVE-2008-2019 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.