CVE-2020-18220

2021-05-2019:55:48

mitre

www.cve.org

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.

References

github.com/doramart/DoraCMS/issues/190