Vulnerability Details CVE-2010-5093
Member_ProfileForm in security/Member.php in SilverStripe 2.3.x before 2.3.7 allows remote attackers to hijack user accounts by saving data using the email address (ID) of another user.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 65.7%
CVSS Severity
CVSS v2 Score 5.0
References
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.7
- http://open.silverstripe.org/changeset/100744
- http://www.openwall.com/lists/oss-security/2012/04/30/1
- http://www.openwall.com/lists/oss-security/2012/04/30/3
- http://www.openwall.com/lists/oss-security/2012/05/01/3
- http://www.silverstripe.org/security-releases
- http://doc.silverstripe.org/sapphire/en/trunk/changelogs//2.3.7
- http://open.silverstripe.org/changeset/100744
- http://www.openwall.com/lists/oss-security/2012/04/30/1
- http://www.openwall.com/lists/oss-security/2012/04/30/3
- http://www.openwall.com/lists/oss-security/2012/05/01/3
- http://www.silverstripe.org/security-releases
Products affected by CVE-2010-5093
-
cpe:2.3:a:silverstripe:silverstripe:2.3.0
-
cpe:2.3:a:silverstripe:silverstripe:2.3.1
-
cpe:2.3:a:silverstripe:silverstripe:2.3.2
-
cpe:2.3:a:silverstripe:silverstripe:2.3.3
-
cpe:2.3:a:silverstripe:silverstripe:2.3.4
-
cpe:2.3:a:silverstripe:silverstripe:2.3.5
-
cpe:2.3:a:silverstripe:silverstripe:2.3.6