PT-2017-8695 · Froxlor Team+1 · Froxlor+1

Published 2017-02-13 · Updated 2022-05-17 · CVE-2016-5100

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 0.9.35

Description The issue makes it easier for remote attackers to guess the password reset token by predicting a value, as the software uses the PHP rand function for random number generation.

Recommendations For versions prior to 0.9.35, update to version 0.9.35 or later to resolve the issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2016-5100

GHSA-QJ6H-M7XC-R2V3

OPENSUSE-SU-2021:0415-1

OPENSUSE-SU-2021:0450-1

OPENSUSE-SU-2021_0415-1

Affected Products

Froxlor

Suse

References · 14

• https://github.com/Froxlor/Froxlor/commit/da4ec3e1b591de96675817a009e26e05e848a6ba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-5100 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0450-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5100 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0415-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qj6h-m7xc-r2v3 · Vendor Advisory
• https://github.com/Froxlor/Froxlor · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/AAUIVTQVXK6DU6ZXURWINSWBU3EBTIT7 · Note
• https://bugzilla.suse.com/1082318 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/7YQHL4MI6XNUZ25CJOTEP4PACP46MIOF · Note
• https://bugzilla.suse.com/958100 · Note
• https://bugzilla.suse.com/846355 · Note
• https://bugzilla.suse.com/1025193 · Note
• https://suse.com/security/cve/CVE-2016-5100 · Note