« Volver al listado

CVE-2009-2951

Estado: ModificadaAlta (7.5)—

Phenotype CMS before 2.9 does not use a random salt value for password encryption, which makes it easier for context-dependent attackers to determine cleartext passwords.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phenotype-cms — Phenotype CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2951",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-24T15:30:00.217",
  "references": [
    {
      "url": "http://www.phenotype-cms.com/wiki/development-changelog",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52856",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.phenotype-cms.com/wiki/development-changelog",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52856",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Phenotype CMS before 2.9 does not use a random salt value for password encryption, which makes it easier for context-dependent attackers to determine cleartext passwords."
    },
    {
      "lang": "es",
      "value": "Phenotype CMS anterior a v2.9no utiliza una sal -salt- añadida aleatoria para el cifrado de las contraseñas, esto facilita a los atacantes dependientes del contexto llegar a conocer la contraseña en texto plano."
    }
  ],
  "lastModified": "2026-06-16T23:10:34.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBF0838A-2FC3-4407-BBFC-1C6D4632B0E5",
              "versionEndIncluding": "2.8"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A12B07C8-92E1-45A6-97C8-ED81A50B7A60"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D584096C-20F6-48E2-AFED-43C35E0D102F"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D3DDB99-189F-4239-998E-FB03304F67B0"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E80761B-1C6C-4E1F-98BD-B4D65BA8ED10"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29E323CC-81A8-4997-A89D-7951C51FDBD3"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDFD819F-5AC0-47F3-A9F7-5E4D02058958"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50DE5FF2-DD49-4B5C-B7AF-75824C8AAA8F"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19F09617-AFBD-4FC7-820B-5A43F2AA9668"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13EB4778-9EAB-4E5D-BAE8-75D58A4ECF98"
            },
            {
              "criteria": "cpe:2.3:a:phenotype-cms:phenotype_cms:2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C714422D-4A39-4ED7-B244-05F56CEDF7E9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}