Joomla user password reset vulnerability being actively exploited

SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Joomla user password reset vulnerability being actively exploited
We've received reports from several readers (thanx, Ronaldo and anonymous) that they have seen successful exploitation of the Joomla user password reset vulnerability announced on 12 Aug (with an exploit posted to milw0rm at about the same time). If you have not yet upgraded to 1.5.6, do so ASAP References: http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html http://www.us-cert.gov/current/index.html#joomla_password_reset_vulnerability http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3681	Jim 416 Posts ISC Handler Aug 15th 2008
Subscribe	Aug 15th 2008 1 decade ago