VYPR
← All advisories
High severity7.5NVD Advisory· Published May 20, 2021· Updated Jun 17, 2026

CVE-2020-18220

CVE-2020-18220

Description

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.

Affected products

3
  • DoraCMS/DoraCMSllm-fuzzy2 versions
    <=2.1.1+ 1 more
    • (no CPE)range: <=2.1.1
    • (no CPE)
  • Doramart/Doracms
    cpe:2.3:a:html-js:doracms:*:*:*:*:*:*:*:*
    Range: <=2.1.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.