← Database

CVE-2008-3681

HIGH CVSS: 7.5 Published: 2008-08-14 Modified: 2026-06-16

Description

components/com_user/models/reset.php in Joomla! 1.5 through 1.5.5 does not properly validate reset tokens, which allows remote attackers to reset the "first enabled user (lowest id)" password, typically for the administrator.

Affected Platforms

Joomla Com User

Weakness Type

CWE-264

References