CVE-2010-5080

The Security/changepassword URL action in SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 passes a token as a GET parameter while changing a password through email, which allows remote attackers to obtain sensitive data and hijack the session via the HTTP referer logs on a server, aka "HT...

CVE-2010-5080

SilverStripe’s changepassword action (2.3.x before 2.3.10; 2.4.x before 2.4.4) passes a token via GET when changing a password, enabling HTTP referer leakage that can expose session data. Remote attackers could hijack sessions by inspecting referer logs on the server. Affected versions and exact ...