1. Home
  2. CVE Database
  3. CVE-2019-19735
CRITICAL · 9.1

CVE-2019-19735

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set th...

Vulnerability Description

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set the password within a few hours by bruteforcing.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
MfscriptsYetishare>= 3.5.2, <= 4.5.3

Related Weaknesses (CWE)

CWE-916

References

FAQ

What is CVE-2019-19735?

CVE-2019-19735 is a vulnerability with a CVSS score of 9.1 (CRITICAL). class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes (based only on microtime), which allows an attacker to guess the hash and set th...

How severe is CVE-2019-19735?

CVE-2019-19735 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2019-19735?

Check the references section above for vendor advisories and patch information. Affected products include: Mfscripts Yetishare.