← back
CVE-2010-5079

CVE-2010-5079

EPSS 1.9%
SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors.
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4http://open.silverstripe.org/changeset/114497http://open.silverstripe.org/changeset/114498http://open.silverstripe.org/changeset/114503http://open.silverstripe.org/changeset/114504http://open.silverstripe.org/changeset/114505http://www.openwall.com/lists/oss-security/2011/01/03/12http://www.openwall.com/lists/oss-security/2012/04/30/1http://www.openwall.com/lists/oss-security/2012/04/30/3http://www.openwall.com/lists/oss-security/2012/05/01/3