PHP Censor uses a weak hashing algorithm for the remember me key

2024-05-1418:31:02

Google

osv.dev

php

weak hashing

remember me

software vulnerability

6.9 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remember_key value to gain access to accounts that have checked “remember me” when logging in.

CPENameOperatorVersion
php-censor/php-censoreq1.0.15
php-censor/php-censoreq2.0.4
php-censor/php-censoreq1.0.14
php-censor/php-censoreq0.5.0
php-censor/php-censoreq1.2.1
php-censor/php-censoreq2.0.2
php-censor/php-censoreq1.1.3
php-censor/php-censoreq2.0.12
php-censor/php-censoreq1.0.4
php-censor/php-censoreq0.20.0

Name	Operator	Version
php-censor/php-censor	eq	1.0.15
php-censor/php-censor	eq	2.0.4
php-censor/php-censor	eq	1.0.14
php-censor/php-censor	eq	0.5.0
php-censor/php-censor	eq	1.2.1
php-censor/php-censor	eq	2.0.2
php-censor/php-censor	eq	1.1.3
php-censor/php-censor	eq	2.0.12
php-censor/php-censor	eq	1.0.4
php-censor/php-censor	eq	0.20.0