Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
DoraCMS 加密问题漏洞
Vulnerability Description
DoraCMS是一个应用软件。基于Nodejs + eggjs + mongodb编写的一套内容管理系统。 DoraCMS v2.1.1版本及之前版本存在安全漏洞，该漏洞源于没有使用随机salt AES-CBC 加密，使得为用户加密的密码容易受到字典攻击，使得攻击者可利用该漏洞可以获得敏感信息。
CVSS Information
N/A
Vulnerability Type
N/A