Lucene search

GitHub Advisory DatabaseGHSA-FQW7-839J-HVXJ

HistoryMay 14, 2024 - 6:31 p.m.

PHP Censor uses a weak hashing algorithm for the remember me key

2024-05-1418:31:02

CWE-327

GitHub Advisory Database

github.com

php censor

weak hashing algorithm

remember key

vulnerability

bruteforce

accounts

software

6.9 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remember_key value to gain access to accounts that have checked “remember me” when logging in.

Affected configurations

Vulners

Node

php-censorphp-censorRange<2.0.13

php-censorphp-censorRange<2.1.5

CPENameOperatorVersion
php-censor/php-censorlt2.0.13
php-censor/php-censorlt2.1.5

CPE	Name	Operator	Version
	php-censor/php-censor	lt	2.0.13
	php-censor/php-censor	lt	2.1.5

References

chmod744.super.site/redacted-vulnerability

github.com/advisories/GHSA-fqw7-839j-hvxj

github.com/php-censor/php-censor/commit/7b011d1b60f543e6ed814315a285cc80074d12e5

nvd.nist.gov/vuln/detail/CVE-2024-34914