2 CVEs publicados el 2022-05-13 · CVSS máximo 9.8/10.
Productos afectados (catálogo NVD)
airsonic_project/airsonic
CVEs de este lote
| CVE | Severidad | CVSS | EPSS | Estado | Descripción |
|---|---|---|---|---|---|
| CVE-2019-10907 | CRITICAL | 9.8 | 0.9% | Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. | |
| CVE-2019-10908 | CRITICAL | 9.8 | 1.6% | In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bru |