CVE-2022-1252

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-1252
Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://0g.vc/posts/insecure-cipher-gnuboard5/ Exploit Third Party Advisory
https://huntr.dev/bounties/c8c2c3e1-67d0-4a11-a4d4-11af567a9ebb Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gnuboard:gnuboard5:*:*:*:*:*:*:*:*
History

02 Aug 2023, 09:15

Type Values Removed Values Added
Summary Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents Use of a Broken or Risky Cryptographic Algorithm in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents

24 Jul 2023, 13:45

Type Values Removed Values Added
CWE CWE-359
CWE-326		 CWE-327

13 May 2022, 12:23

Type Values Removed Values Added
CWE CWE-326
CVSS v2 : 5.0
v3 : 7.5 		v2 : 6.4
v3 : 9.1

22 Apr 2022, 10:15

Type Values Removed Values Added
Summary Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository gnuboard/gnuboard5 prior to and including 5.5.5. A vulnerability in gnuboard v5.5.5 and below uses weak encryption algorithms leading to sensitive information exposure. This allows an attacker to derive the email address of any user, including when the 'Let others see my information.' box is ticked off. Or to send emails to any email address, with full control of its contents

15 Apr 2022, 03:24

Type Values Removed Values Added
First Time Gnuboard
Gnuboard gnuboard5
References (CONFIRM) https://huntr.dev/bounties/c8c2c3e1-67d0-4a11-a4d4-11af567a9ebb - (CONFIRM) https://huntr.dev/bounties/c8c2c3e1-67d0-4a11-a4d4-11af567a9ebb - Exploit, Third Party Advisory
References (MISC) https://0g.vc/posts/insecure-cipher-gnuboard5/ - (MISC) https://0g.vc/posts/insecure-cipher-gnuboard5/ - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 7.5
CPE cpe:2.3:a:gnuboard:gnuboard5:*:*:*:*:*:*:*:*

11 Apr 2022, 12:15

Type Values Removed Values Added
References
  • (MISC) https://0g.vc/posts/insecure-cipher-gnuboard5/ -

11 Apr 2022, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-04-11 11:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-1252

Mitre link : CVE-2022-1252

CVE.ORG link : CVE-2022-1252

JSON object : View

Products Affected

gnuboard

  • gnuboard5
CWE
CWE-327

Use of a Broken or Risky Cryptographic Algorithm