CVE-2026-80211

Katalog CVE

CVSS 5.9 · Medium EPSS 0,31%

Kerentanan Use of Password Hash With Insufficient Computational Effort. Skor CVSS 3.1 5.9 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way, and authentication calls get_user_auth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to password_hash(), password_verify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

5.9 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/FrontAccountingERP/FA
• https://github.com/FrontAccountingERP/FA/blob/9464a3ffef03c139d9396e697bce9a0a9f131a72/includes/current_user.i...
• https://github.com/geo-chen/oss/blob/main/FA.md#finding-2-unsalted-md5-password-hashing-in-frontaccounting
• https://www.vulncheck.com/advisories/frontaccounting-through-2.4.20-use-of-unsalted-md5-for-password-storage