CVE-2019-10907
Last modified
CVE-2019-10907 is a vulnerability of currently unknown severity. Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.. EPSS estimates a 0.92% chance of exploitation in the next 30 days.
Description
Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Airsonic Project | Airsonic | 10.2.1 |
References
- https://github.com/airsonic/airsonic/commit/3e07ea52885f88d3fbec444dfd592f27bfb65647Patch, Third Party Advisory
- https://github.com/airsonic/airsonic/commit/3e07ea52885f88d3fbec444dfd592f27bfb65647Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10907?
How severe is CVE-2019-10907?
How do I fix CVE-2019-10907?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10901In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
- CVE-2019-10902In Wireshark 3.0.0, the TSDNS dissector could crash. This wa…
- CVE-2019-10903In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the…7.5
- CVE-2019-10904Roundup 1.6 allows XSS via the URI because frontends/roundup…
- CVE-2019-10905Parsedown before 1.7.2, when safe mode is used and HTML mark…
- CVE-2019-10906In Pallets Jinja before 2.10.1, str.format_map allows a sand…8.6
- CVE-2019-10908In Airsonic 10.2.1, RecoverController.java generates passwor…
- CVE-2019-10909In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.…5.4
- CVE-2019-1091An information disclosure vulnerability exists when Unistore…
- CVE-2019-10910In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.…9.8
- CVE-2019-10911In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.…7.5
- CVE-2019-10912In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.…
Are you affected by CVE-2019-10907?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST