Design/Logic Flaw

2021-05-2020:15:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.4%

JSON

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.

CPENameOperatorVersion
doracmsle2.1.1

CPE	Name	Operator	Version
	doracms	le	2.1.1

References

github.com/doramart/DoraCMS/issues/190