CVE-2013-7305

fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2014-01-22

Last modified

2024-09-16

Weaknesses

CWE-255

Affected products

• E107 (E107)

References

• http://sourceforge.net/p/e107/svn/13114