GitHub Advisoryadvisory · Packagist

GHSA-qj6h-m7xc-r2v3 Froxlor guessable password reset token

CRITICAL Published 2022-05-17 Modified 2024-04-25 Official page ↗
Aliases
CVE-2016-5100
Ecosystem
Packagist
Packages
froxlor/froxlor
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-330
Reviewed
2024-04-25

Affected packages

• Packagist froxlor/froxlor: < 0.9.35 → fixed in 0.9.35

Description

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.

Related

Alias · CVE (1)

  • CVE-2016-5100 Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the… vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References