CVE-2010-5079 | Vulnerability Database | Aqua Security

SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) forgot password functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors.

Affected Software

Name	Vendor	Start Version	End Version
Silverstripe	Silverstripe	2.3.0 (including)	2.3.0 (including)
Silverstripe	Silverstripe	2.3.1 (including)	2.3.1 (including)
Silverstripe	Silverstripe	2.3.2 (including)	2.3.2 (including)
Silverstripe	Silverstripe	2.3.3 (including)	2.3.3 (including)
Silverstripe	Silverstripe	2.3.4 (including)	2.3.4 (including)
Silverstripe	Silverstripe	2.3.5 (including)	2.3.5 (including)
Silverstripe	Silverstripe	2.3.6 (including)	2.3.6 (including)
Silverstripe	Silverstripe	2.3.7 (including)	2.3.7 (including)
Silverstripe	Silverstripe	2.3.8 (including)	2.3.8 (including)
Silverstripe	Silverstripe	2.3.9 (including)	2.3.9 (including)

References

http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10
http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4
http://open.silverstripe.org/changeset/114497
http://open.silverstripe.org/changeset/114498
http://open.silverstripe.org/changeset/114503
http://open.silverstripe.org/changeset/114504
http://open.silverstripe.org/changeset/114505
http://www.openwall.com/lists/oss-security/2011/01/03/12
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
http://www.openwall.com/lists/oss-security/2012/05/01/3

NVD	https://nvd.nist.gov/vuln/detail/CVE-2010-5079
CWE	https://cwe.mitre.org/data/definitions/310.html