PatchTheCVECVE-2016-2564: Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP u
CVE-2016-2564 is a medium-severity flaw (CVSS 5.9) affecting invision power board. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.3% (top 30%) |
| CISA exploited list | No |
| Weakness | CWE-331 |
| Published | 2017-04-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2016-2564?
invision power board: upgrade to newer than 4.1.8.1. Exact commands for each OS are on this page.
Is CVE-2016-2564 being exploited?
CVE-2016-2564 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2016-2564 affect?
CVE-2016-2564 affects invision power board. Severity is medium (CVSS 5.9). Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the e
How urgent is CVE-2016-2564?
Priority 43/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2021-39250 MEDIUM 5.4 UPGRADE Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code
- CVE-2021-39249 MEDIUM 6.1 UPGRADE Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filen
- CVE-2019-8278 MEDIUM 6.1 UPGRADE Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.
- CVE-2017-8899 HIGH 8.1 UPGRADE Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Informati
- CVE-2017-8898 CRITICAL 9.8 UPGRADE Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowi