[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Vulnerability in CB Captcha for Joomla and Mambo
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Re: Vulnerability in CB Captcha for Joomla and Mambo
- From: nant@xxxxxxxxxxxxxxx
- Date: 16 Apr 2010 14:04:50 -0000
Hello viewers.
This is Nick (aka nant) - one of the original (not the forked Russian version)
CB Captcha plugin developers. We are responsible for version 2.2 that is
referenced in the report.
Some facts for those reading:
MustLive notified us on 13.4.2010 - that's 13 days after disclosure.
This should not be classified as any kind of vulnerability as there is no way
that any harm can be done to a website using this script.
The CB Captcha 2.2 plugin, as all similar Captcha scripts, are used to insure
that human intervention is needed. The "bug" (at best) reported only allows a
single user seeing the generated Captcha image, to use its code during the
active session period.
There is no harm that can be done to the system using this. Thus while this is
a bit of odd behavior it does not represent a asecurity flaw.
This will be fixed however as soon as possible.
Thank you.