CVE-2010-5093 | Vulnerability Database | Aqua Security

Member_ProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address (ID) of another user.

Affected Software

Name	Vendor	Start Version	End Version
Silverstripe	Silverstripe	2.3.0 (including)	2.3.0 (including)
Silverstripe	Silverstripe	2.3.0-rc1 (including)	2.3.0-rc1 (including)
Silverstripe	Silverstripe	2.3.0-rc2 (including)	2.3.0-rc2 (including)
Silverstripe	Silverstripe	2.3.0-rc3 (including)	2.3.0-rc3 (including)
Silverstripe	Silverstripe	2.3.1 (including)	2.3.1 (including)
Silverstripe	Silverstripe	2.3.1-rc1 (including)	2.3.1-rc1 (including)
Silverstripe	Silverstripe	2.3.1-rc2 (including)	2.3.1-rc2 (including)
Silverstripe	Silverstripe	2.3.2 (including)	2.3.2 (including)
Silverstripe	Silverstripe	2.3.3 (including)	2.3.3 (including)
Silverstripe	Silverstripe	2.3.4 (including)	2.3.4 (including)
Silverstripe	Silverstripe	2.3.5 (including)	2.3.5 (including)
Silverstripe	Silverstripe	2.3.6 (including)	2.3.6 (including)

References

http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.7
http://open.silverstripe.org/changeset/100744
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
http://www.openwall.com/lists/oss-security/2012/05/01/3
http://www.silverstripe.org/security-releases
http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.7
http://open.silverstripe.org/changeset/100744
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
http://www.openwall.com/lists/oss-security/2012/05/01/3
http://www.silverstripe.org/security-releases

NVD	https://nvd.nist.gov/vuln/detail/CVE-2010-5093
CWE	https://cwe.mitre.org/data/definitions/264.html