CVE-2019-10907

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.

Airsonic 10.2.1 utiliza por defecto el mecanismo remember-me basado en MD5 de Spring con una clave fija de airsonic en GlobalSecurityConfig.java. Un atacante capaz de capturar cookies podría simplemente obtener las contraseñas offline de los usuarios asociados mediante el uso de fuerza bruta.