CVE-2019-10907
EUVD-2019-262607.04.2019, 14:29
Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| airsonic_project | airsonic | 10.2.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration