CVE-2020-18220

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its…

published May 20, 2021

CVSS
—
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.3th percentile
Published
2021-05-20T19:55Z
EPSS history
Timeline
  • 20 MAY 19:55Z
    Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its…
    cvelistv5