Upstream information
Description
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having critical severity.
| CVSS detail | National Vulnerability Database |
|---|---|
| Base Score | 5 |
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | None |
| Availability Impact | None |
| CVSS detail | National Vulnerability Database |
|---|---|
| Base Score | 9.8 |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CVSSv3 Version | 3 |
SUSE Security Advisories:
- openSUSE-SU-2021:0415-1, published Tue Mar 16 21:38:43 2021
- openSUSE-SU-2021:0450-1, published Sat Mar 20 00:38:02 2021
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Package Hub 15 SP2 |
| Patchnames: openSUSE-2021-450 |
| openSUSE Leap 15.2 |
| Patchnames: openSUSE-2021-415 |
SUSE Timeline for this CVE
CVE page created: Mon Feb 13 21:15:16 2017CVE page last modified: Mon Oct 6 18:25:28 2025