CRITICAL🇵🇱 Wersja polska

CVE-2018-16988

CVSS 9.8v3.1pub. 2019-05-02upd. 2026-06-08

An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force attack against an MD5 rid value requires only 600 guesses in the plausible situation where the attacker knows that the victim has started a password-reset process (pass_reset.php, password_reset.php, XDUser.php) in the past few minutes.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Buffalo Open Xdmod

    APP
    Buffalo
    < 8.0.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-45777CRITICAL9.3PL ✓ten sam produkt

RCE poprzez command injection w Open XDMoD (wersje 9.5.0–11.0.2)

CVE-2026-45779CRITICAL9.3PL ✓ten sam produkt

SQL Injection w Open XDMoD — nieuwierzytelniony dostęp do bazy danych

CVE-2026-45778HIGH8.6ten sam produkt

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, an authentic...

CVE-2018-16961HIGH7.5ten sam produkt

An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/dl_publication.php allows Path traversal...

CVE-2026-45776MEDIUM5.3ten sam produkt

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Op...