CVEvulnerability
CVE-2010-5079
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-09-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-310
Description
SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors.
Affected configurations
• silverstripe silverstripe 2.3.0
• silverstripe silverstripe 2.3.1
• silverstripe silverstripe 2.3.2
• silverstripe silverstripe 2.3.3
• silverstripe silverstripe 2.3.4
• silverstripe silverstripe 2.3.5
• silverstripe silverstripe 2.3.6
• silverstripe silverstripe 2.3.7
• silverstripe silverstripe 2.3.8
• silverstripe silverstripe 2.3.9
• silverstripe silverstripe 2.4.0
• silverstripe silverstripe 2.4.1
• silverstripe silverstripe 2.4.2
• silverstripe silverstripe 2.4.3
Related
Weakness · not in database (1)
References
- http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10 Patch
- http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4 Patch, Vendor Advisory
- http://open.silverstripe.org/changeset/114497 open.silverstripe.org
- http://open.silverstripe.org/changeset/114498 Patch
- http://open.silverstripe.org/changeset/114503 Patch
- http://open.silverstripe.org/changeset/114504 Patch
- http://open.silverstripe.org/changeset/114505 Patch
- http://www.openwall.com/lists/oss-security/2011/01/03/12 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/05/01/3 www.openwall.com
- http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10 Patch
- http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4 Patch, Vendor Advisory
- http://open.silverstripe.org/changeset/114497 open.silverstripe.org
- http://open.silverstripe.org/changeset/114498 Patch
- http://open.silverstripe.org/changeset/114503 Patch
- http://open.silverstripe.org/changeset/114504 Patch
- http://open.silverstripe.org/changeset/114505 Patch
- http://www.openwall.com/lists/oss-security/2011/01/03/12 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/1 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/04/30/3 www.openwall.com
- http://www.openwall.com/lists/oss-security/2012/05/01/3 www.openwall.com