CVE-2011-4321

Published: Nov 23, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The password reset functionality in Joomla! 1.5.x through 1.5.24 uses weak random numbers, which makes it easier for remote attackers to change the passwords of arbitrary users via unspecified vectors.

Affected (26)

Products: Joomla: Joomla!

Joomla

1 product

Joomla!

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Joomla Joomla!	Version 1.5.0
Joomla Joomla!	Version 1.5.10
Joomla Joomla!	Version 1.5.11
Joomla Joomla!	Version 1.5.12
Joomla Joomla!	Version 1.5.13
Joomla Joomla!	Version 1.5.14
Joomla Joomla!	Version 1.5.15
Joomla Joomla!	Version 1.5.15 rc
Joomla Joomla!	Version 1.5.16
Joomla Joomla!	Version 1.5.17
Joomla Joomla!	Version 1.5.18
Joomla Joomla!	Version 1.5.19
Joomla Joomla!	Version 1.5.1
Joomla Joomla!	Version 1.5.20
Joomla Joomla!	Version 1.5.21
Joomla Joomla!	Version 1.5.22
Joomla Joomla!	Version 1.5.23
Joomla Joomla!	Version 1.5.24
Joomla Joomla!	Version 1.5.2
Joomla Joomla!	Version 1.5.3
Joomla Joomla!	Version 1.5.4
Joomla Joomla!	Version 1.5.5
Joomla Joomla!	Version 1.5.6
Joomla Joomla!	Version 1.5.7
Joomla Joomla!	Version 1.5.8
Joomla Joomla!	Version 1.5.9

Related CWEs

CWE-310

References (4)

http://developer.joomla.org/security/news/9-security/10-core-security/375-20111103-core-password-change

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2011/11/21/1

Source: secalert@redhat.com

http://developer.joomla.org/security/news/9-security/10-core-security/375-20111103-core-password-change

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2011/11/21/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.