PT-2012-1335 · Silverstripe · Silverstripe

Published 2012-08-26 · Updated 2012-08-27 · CVE-2010-5092

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SilverStripe version 2.4.0

Description The issue concerns the Add Member dialog in the Security admin page, where user passwords are saved in plaintext. This allows local users to obtain sensitive information by reading the database.

Recommendations For SilverStripe version 2.4.0, consider updating the password storage mechanism to hash and salt passwords instead of storing them in plaintext, or apply a configuration change to securely store user credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2010-5092

Affected Products

Silverstripe

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-5092 · Security Note
• http://open.silverstripe.org/changeset/107532 · Patch
• http://openwall.com/lists/oss-security/2012/04/30/1 · Note
• http://openwall.com/lists/oss-security/2012/04/30/3 · Note
• http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1 · Note
• http://open.silverstripe.org/ticket/5772 · Note
• http://openwall.com/lists/oss-security/2012/05/01/3 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5092 · Note