CVE-2016-5100 Froxlor guessable password reset token
CriticalCVSS 9.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| froxlor(Packagist) | < 0.9.35 | 0.9.35 |
| froxlor | <= 0.9.34.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch third-party-advisory
- github.com product
- github.com