Description

member.php in MyBB (aka MyBulletinBoard), when debug mode is available, allows remote authenticated users to change the password of any account by providing the account's registered e-mail address in a debug request for a do_lostpw action, which prints the change password verification code in the debug output.

Remediation

References

CVE-2007-1964

Related Vulnerabilities

WordPress Plugin MW WP Form Security Bypass (4.4.5)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-5597)

WordPress Plugin TubePress Cross-Site Scripting (1.6.0)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Request Forgery (2.0.20)

WebLogic CVE-2010-4453 Vulnerability (CVE-2010-4453)

Severity

Medium

Classification

CVE-2007-1964

Tags

Missing Update Known Vulnerabilities