PT-2012-1335 · Silverstripe · Silverstripe

Publicado 2012-08-26 · Atualizado 2012-08-27 · CVE-2010-5092

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe version 2.4.0

Description The issue concerns the Add Member dialog in the Security admin page, where user passwords are saved in plaintext. This allows local users to obtain sensitive information by reading the database.

Recommendations For SilverStripe version 2.4.0, consider updating the password storage mechanism to hash and salt passwords instead of storing them in plaintext, or apply a configuration change to securely store user credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2010-5092

Produtos afetados

Silverstripe

Referências · 8

• http://openwall.com/lists/oss-security/2012/04/30/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-5092 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/04/30/3 · Nota
• http://open.silverstripe.org/changeset/107532 · Correção
• http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1 · Nota
• http://open.silverstripe.org/ticket/5772 · Nota
• http://openwall.com/lists/oss-security/2012/05/01/3 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5092 · Nota