{"api_version":"1","generated_at":"2026-07-23T08:31:58+00:00","cve":"CVE-2006-5474","urls":{"html":"https://cve.report/CVE-2006-5474","api":"https://cve.report/api/cve/CVE-2006-5474.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-5474","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-5474"},"summary":{"title":"CVE-2006-5474","description":"The \"forgot password\" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-10-24 20:07:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.whitedust.net/speaks/3043/","name":"http://www.whitedust.net/speaks/3043/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"Whitedust.net - The Best security antivirus network Resources and Information. This website is for sale!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/20651","name":"http://www.securityfocus.com/bid/20651","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"OneOrZero Open Source Task Management and Help Desk System Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://oneorzero.com/downloads/release_notes/Current_Release_notes.html","name":"http://oneorzero.com/downloads/release_notes/Current_Release_notes.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/22476","name":"http://secunia.com/advisories/22476","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"OneOrZero Helpdesk Insecure Password Generation Security Issue - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/1767","name":"http://securityreason.com/securityalert/1767","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Advisory for Oneorzero helpdesk - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/449352/100/0/threaded","name":"http://www.securityfocus.com/archive/1/449352/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-5474","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-5474","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"5474","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oneorzero","cpe5":"oneorzero_helpdesk","cpe6":"1.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"5474","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oneorzero","cpe5":"oneorzero_helpdesk","cpe6":"1.6.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"5474","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oneorzero","cpe5":"oneorzero_helpdesk","cpe6":"1.6.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"5474","vulnerable":"1","versionEndIncluding":"1.6.5.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oneorzero","cpe5":"oneorzero_helpdesk","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T19:48:30.530Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.whitedust.net/speaks/3043/"},{"name":"22476","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/22476"},{"name":"20061020 Advisory for Oneorzero helpdesk","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/449352/100/0/threaded"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://oneorzero.com/downloads/release_notes/Current_Release_notes.html"},{"name":"1767","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/1767"},{"name":"20651","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/20651"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-10-20T00:00:00.000Z","descriptions":[{"lang":"en","value":"The \"forgot password\" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-17T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://www.whitedust.net/speaks/3043/"},{"name":"22476","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/22476"},{"name":"20061020 Advisory for Oneorzero helpdesk","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/449352/100/0/threaded"},{"tags":["x_refsource_CONFIRM"],"url":"http://oneorzero.com/downloads/release_notes/Current_Release_notes.html"},{"name":"1767","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/1767"},{"name":"20651","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/20651"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-5474","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The \"forgot password\" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.whitedust.net/speaks/3043/","refsource":"MISC","url":"http://www.whitedust.net/speaks/3043/"},{"name":"22476","refsource":"SECUNIA","url":"http://secunia.com/advisories/22476"},{"name":"20061020 Advisory for Oneorzero helpdesk","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/449352/100/0/threaded"},{"name":"http://oneorzero.com/downloads/release_notes/Current_Release_notes.html","refsource":"CONFIRM","url":"http://oneorzero.com/downloads/release_notes/Current_Release_notes.html"},{"name":"1767","refsource":"SREASON","url":"http://securityreason.com/securityalert/1767"},{"name":"20651","refsource":"BID","url":"http://www.securityfocus.com/bid/20651"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-5474","datePublished":"2006-10-24T20:00:00.000Z","dateReserved":"2006-10-24T00:00:00.000Z","dateUpdated":"2024-08-07T19:48:30.530Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-10-24 20:07:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oneorzero:oneorzero_helpdesk:*:*:*:*:*:*:*:*","versionEndIncluding":"1.6.5.3","matchCriteriaId":"77B9BA4F-5FD4-4C37-836D-1F88D47DF543"},{"vulnerable":true,"criteria":"cpe:2.3:a:oneorzero:oneorzero_helpdesk:1.6:*:*:*:*:*:*:*","matchCriteriaId":"71F48E6F-1E7A-4B5F-9A05-37B2D7D39BE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:oneorzero:oneorzero_helpdesk:1.6.3:*:*:*:*:*:*:*","matchCriteriaId":"10E97153-B0A5-4751-B657-79EF676FABD6"},{"vulnerable":true,"criteria":"cpe:2.3:a:oneorzero:oneorzero_helpdesk:1.6.4:*:*:*:*:*:*:*","matchCriteriaId":"BC596188-DBD8-4E56-953D-23B865670926"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"5474","Ordinal":"1","Title":"CVE-2006-5474","CVE":"CVE-2006-5474","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"5474","Ordinal":"1","NoteData":"The \"forgot password\" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset.","Type":"Description","Title":"CVE-2006-5474"},{"CveYear":"2006","CveId":"5474","Ordinal":"2","NoteData":"2006-10-24","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"5474","Ordinal":"3","NoteData":"2018-10-17","Type":"Other","Title":"Modified"}]}}}