Security News
[20111103] - Core - Password Change
- Project: Joomla!
- SubProject: All
- Severity: High
- Versions: 1.5.24 and all earlier 1.5 versions
- Exploit type: Password Change
- Reported Date: 2011-October-28
- Fixed Date: 2011-November-14
Description
Weak random number generation during password reset leads to possibility of changing a user's password.
Affected Installs
Joomla! version 1.5.24 and all earlier 1.5 versions
Solution
Upgrade to the latest Joomla! 1.5 version (1.5.25 or later)
Reported by Gregor Kopf and David Jardin
Contact
The JSST at the Joomla! Security Center.
