CVE-2016-5100 Froxlor guessable password reset token
Remote attackers can predict password reset tokens due to weak random number generation, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-5100?
CVE-2016-5100 is a critical vulnerability in n/a, published on 13 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
Weakness: CWE-330
Which versions are affected by CVE-2016-5100?
2 open source packages ship an affected version, including froxlor/froxlor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
froxlor/froxlor Packagist | All versions | 0.9.35 |
froxlor/froxlor Packagist | All versions | 0.9.35 |
Linux distribution packages (2)
froxlor SUSE:Package Hub 15 SP2 | All versions | 0.10.23-bp152.4.3.1 |
froxlor openSUSE:Leap 15.2 | All versions | 0.10.23-lp152.4.3.1 |
Products include Froxlor Froxlor.
How do I fix CVE-2016-5100?
Upgrade froxlor/froxlor to 0.9.35 or later.
Is CVE-2016-5100 being exploited?
There is no known exploitation of CVE-2016-5100 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-41228 Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Execution
- CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor
- CVE-2023-0671 Code Injection in froxlor/froxlor
- CVE-2023-3173 Improper Restriction of Excessive Authentication Attempts in froxlor/froxlor
- CVE-2023-1307 Authentication Bypass by Primary Weakness in froxlor/froxlor
Sources
Also known as GHSA-qj6h-m7xc-r2v3, openSUSE-SU-2021:0415-1, openSUSE-SU-2021:0450-1.