CVE-2009-5014
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt...
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.
Exploit likelihood
What each source reports
NVD Score used
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.
- Record
CVE-2009-5014- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.
- Record
CVE-2009-5014- Updated
- 2026-11-02
EUVDEUVD-2009-4972 No score
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.
- Record
EUVD-2009-4972- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-px96-54jm-q7g6 No score
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt...
The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.
- Record
GHSA-px96-54jm-q7g6- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-5014 is a high vulnerability (CVSS 7.5) in Turbogears Turbogears2, published November 5, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. No source names a fixed version.