CVE-2019-15955

An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead of O(n)=n^x complexity, and steal the admin password.

An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with O(n)=2n instead of O(n)=n^x complexity, and steal the admin password.

Se detectó un problema en Total.js CMS versión 12.0.0. Un usuario con pocos privilegios puede realizar una transformación simple de una cookie para obtener los valores aleatorios dentro de ella. Si un atacante puede descubrir una cookie de sesión propiedad de un administrador, entonces es posible forzarla con una complejidad O(n)=2n instead of O(n)=n^x , y robar la contraseña de administrador.