{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) \"forgot password\" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-10-03T16:21:02", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://open.silverstripe.org/changeset/114505"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://open.silverstripe.org/changeset/114503"}, {"name": "[oss-security] 20120501 Re: CVE-request: SilverStripe before 2.4.4", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/05/01/3"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://open.silverstripe.org/changeset/114504"}, {"name": "[oss-security] 20120430 CVE-request: SilverStripe before 2.4.4", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/04/30/1"}, {"name": "[oss-security] 20120430 Re: CVE-request: SilverStripe before 2.4.4", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/04/30/3"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://open.silverstripe.org/changeset/114498"}, {"name": "[oss-security] 20110104 CVE request: silverstripe before 2.4.4", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2011/01/03/12"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://open.silverstripe.org/changeset/114497"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2010-5079", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) \"forgot password\" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://open.silverstripe.org/changeset/114505", "refsource": "CONFIRM", "url": "http://open.silverstripe.org/changeset/114505"}, {"name": "http://open.silverstripe.org/changeset/114503", "refsource": "CONFIRM", "url": "http://open.silverstripe.org/changeset/114503"}, {"name": "[oss-security] 20120501 Re: CVE-request: SilverStripe before 2.4.4", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/05/01/3"}, {"name": "http://open.silverstripe.org/changeset/114504", "refsource": "CONFIRM", "url": "http://open.silverstripe.org/changeset/114504"}, {"name": "[oss-security] 20120430 CVE-request: SilverStripe before 2.4.4", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/04/30/1"}, {"name": "[oss-security] 20120430 Re: CVE-request: SilverStripe before 2.4.4", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/04/30/3"}, {"name": "http://open.silverstripe.org/changeset/114498", "refsource": "CONFIRM", "url": "http://open.silverstripe.org/changeset/114498"}, {"name": "[oss-security] 20110104 CVE request: silverstripe before 2.4.4", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2011/01/03/12"}, {"name": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4", "refsource": "CONFIRM", "url": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4"}, {"name": "http://open.silverstripe.org/changeset/114497", "refsource": "CONFIRM", "url": "http://open.silverstripe.org/changeset/114497"}, {"name": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10", "refsource": "CONFIRM", "url": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10"}]}}}}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2010-5079", "datePublished": "2022-10-03T16:21:02", "dateReserved": "2022-10-03T00:00:00", "dateUpdated": "2022-10-03T16:21:02", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "24734325-97DA-4B2C-B192-3F4B83CCF0C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "609BEA7D-81F2-4DFE-AB2A-157A6B7DE348", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "7856E216-D7B7-48A5-9D20-9F1973DA005D", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "DF4FF5F5-6565-4EA1-8099-2C4C964DA006", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "7E0AD691-1BA2-4D8B-935C-B2C7A31BD5ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "2AD30632-B31E-4425-827E-205351ABECE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "706247B5-ACA3-4863-BDBC-B42EA95E1476", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "87690027-1CF7-477E-91FE-87E6F77B2988", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "9731FCBA-AA01-4510-87B1-E547AD28D09D", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.3.9:*:*:*:*:*:*:*", "matchCriteriaId": "0EE10366-8242-49B1-9F4F-E79304424A27", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "F5BCB4DE-0432-4378-8A31-81208794EBD7", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "DE198516-3D97-4804-84CF-8F9AAC60E795", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "534AD362-1460-4784-97C8-3AA5DD830F94", "vulnerable": true}, {"criteria": "cpe:2.3:a:silverstripe:silverstripe:2.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "FA54E0DE-33DC-445D-8154-4DC580BA8812", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) \"forgot password\" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors."}, {"lang": "es", "value": "SilverStripe 2.3.x antes de 2.3.10 y 2.4.x antes de 2.4.4 utiliza una entrop\u00eda d\u00e9bil para la generaci\u00f3n de fichas para (1) el mecanismo de protecci\u00f3n CSRF, (2) el inicio de sesi\u00f3n autom\u00e1tico (autologin), (3) la funcionalidad \"Olvid\u00f3 su contrase\u00f1a\" y (4) los \"password salts\", lo que hace que sea m\u00e1s f\u00e1cil para los atacantes remotos evitar las restricciones de acceso a trav\u00e9s de vectores no especificados."}], "id": "CVE-2010-5079", "lastModified": "2012-09-18T04:00:00.000", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-09-17T17:55:02.750", "references": [{"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4"}, {"source": "secalert@redhat.com", "url": "http://open.silverstripe.org/changeset/114497"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://open.silverstripe.org/changeset/114498"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://open.silverstripe.org/changeset/114503"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://open.silverstripe.org/changeset/114504"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://open.silverstripe.org/changeset/114505"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2011/01/03/12"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/04/30/1"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/04/30/3"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/05/01/3"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}