Read the docs
TI-2011-00804 Aliases CVE-2011-0910GHSA-rhp4-wj2m-wjjx

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.

Why it matters now

EPSS 0.01047 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:vanillaforums:vanilla:*:*:*:*:*:*:*:*up to 2.0.17.5VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.9:*:*:*:*:*:*:*2.0.9VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.10:*:*:*:*:*:*:*2.0.10VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.11:*:*:*:*:*:*:*2.0.11VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.12:*:*:*:*:*:*:*2.0.12VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.13:*:*:*:*:*:*:*2.0.13VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.14:*:*:*:*:*:*:*2.0.14VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.15:*:*:*:*:*:*:*2.0.15VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.16:*:*:*:*:*:*:*2.0.16VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.17:*:*:*:*:*:*:*2.0.17VulnerableVanilla
  • cpe:2.3:a:vanillaforums:vanilla:*:*:*:*:*:*:*:* Versions up to 2.0.17.5 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.10:*:*:*:*:*:*:* Versions 2.0.10 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.11:*:*:*:*:*:*:* Versions 2.0.11 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.12:*:*:*:*:*:*:* Versions 2.0.12 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.13:*:*:*:*:*:*:* Versions 2.0.13 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.14:*:*:*:*:*:*:* Versions 2.0.14 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.15:*:*:*:*:*:*:* Versions 2.0.15 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.16:*:*:*:*:*:*:* Versions 2.0.16 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.17:*:*:*:*:*:*:* Versions 2.0.17 Vulnerable ·Vanilla
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:vanillaforums:vanilla:2.0.17.1:*:*:*:*:*:*:*2.0.17.1VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.17.2:*:*:*:*:*:*:*2.0.17.2VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.17.3:*:*:*:*:*:*:*2.0.17.3VulnerableVanilla
cpe:2.3:a:vanillaforums:vanilla:2.0.17.4:*:*:*:*:*:*:*2.0.17.4VulnerableVanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.17.1:*:*:*:*:*:*:* Versions 2.0.17.1 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.17.2:*:*:*:*:*:*:* Versions 2.0.17.2 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.17.3:*:*:*:*:*:*:* Versions 2.0.17.3 Vulnerable ·Vanilla
  • cpe:2.3:a:vanillaforums:vanilla:2.0.17.4:*:*:*:*:*:*:* Versions 2.0.17.4 Vulnerable ·Vanilla

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0910
  2. 2026-10-03 Alias added: GHSA-rhp4-wj2m-wjjx

References

Other 1

  • TI-2016-08157 The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows… CVSS 3.0HIGH 7.5
  • TI-2018-13393 Vanilla 2.6.x before 2.6.4 allows remote code execution. CVSS 3.0CRITICAL 9.8
  • TI-2011-03188 An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9. CVSS 3.1CRITICAL 9.8
  • TI-2013-03085 Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has… CVSS 2.0HIGH 7.5
  • TI-2013-03084 Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote… CVSS 2.0HIGH 7.5
  • TI-2018-13806 Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because… CVSS 3.0HIGH 7.2
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences