| Package | Affected versions | Patched versions |
|---|---|---|
| airsonic | = 10.2.1 |
Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurityConfig.java. An attacker able to capture cookies might be able to trivially bruteforce offline the passwords of associated users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free