CVE-2016-2564

Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag

published April 23, 2017

CVSS
—
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01273 · 69.5th percentile
Published
2017-04-23T15:00Z
EPSS history
Timeline
  • 23 APR 15:00Z
    Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag
    cvelistv5