Invision Power Board IP.Board 'forum password system' Information Disclosure Vulnerability

Bugtraq ID:	46298
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 09 2011 12:00AM
Updated:	Feb 09 2011 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	Invision Power Services Invision Power Board 3.1.3 Invision Power Services Invision Power Board 3.1.2 Invision Power Services Invision Power Board 3.0.5 Invision Power Services Invision Power Board 3.0.3 Invision Power Services Invision Power Board 3.0.2 Invision Power Services Invision Power Board 3.0.1 Invision Power Services Invision Power Board 3.0 b5 Invision Power Services Invision Power Board 3.0 Invision Power Services Invision Power Board 3.0.4
Not Vulnerable:	Invision Power Services Invision Power Board 3.1.4

Invision Power Board IP.Board 'forum password system' Information Disclosure Vulnerability

Invision Power Board (IP.Board) is a community forum implemented in PHP.

Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

Versions prior to IP.Board 3.1.4 are vulnerable.

Invision Power Board IP.Board 'forum password system' Information Disclosure Vulnerability

Attackers can exploit this issue using a browser.

Invision Power Board IP.Board 'forum password system' Information Disclosure Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Invision Power Board IP.Board 'forum password system' Information Disclosure Vulnerability

References:

• IP.Board Homepage (Invision Power Services)
  
• IP.Board 3.0.x / 3.1.x Security Update and Mobile API Update (IP.Board )
  
• IP.Board 3.0.x / 3.1.x Security Update and Mobile API Update (IP.Board)