VulnerabilityModified
CVE-2010-5092
The Add Member dialog in the Security admin page in SilverStripe 2.4.0 saves user passwords in plaintext, which allows local users to obtain sensitive information by reading a database.
LOW 1.9EPSS 0.35%
Does this matter?
Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.
Description
The Add Member dialog in the Security admin page in SilverStripe 2.4.0 saves user passwords in plaintext, which allows local users to obtain sensitive information by reading a database.
- CVSS 2.0
- 1.9 LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 0.35% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- silverstripe/silverstripe
- Source
- secalert@redhat.com
References
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1
- http://open.silverstripe.org/changeset/107532Patch
- http://open.silverstripe.org/ticket/5772
- http://www.openwall.com/lists/oss-security/2012/04/30/1
- http://www.openwall.com/lists/oss-security/2012/04/30/3
- http://www.openwall.com/lists/oss-security/2012/05/01/3
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.4.1
- http://open.silverstripe.org/changeset/107532Patch
- http://open.silverstripe.org/ticket/5772
- http://www.openwall.com/lists/oss-security/2012/04/30/1
- http://www.openwall.com/lists/oss-security/2012/04/30/3
- http://www.openwall.com/lists/oss-security/2012/05/01/3
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.