{"id":"CVE-2016-5100","aliases":["EUVD-2022-4985","GHSA-qj6h-m7xc-r2v3","openSUSE-SU-2021:0415-1","openSUSE-SU-2021:0450-1"],"status":"published","title":"Froxlor guessable password reset token","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01915,"percentile":0.79966,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-330"],"published":"2017-02-13T18:00:00Z","modified":"2026-10-20T10:47:30Z","fixes":[{"ecosystem":"Packagist","package":"froxlor/froxlor","fixed_in":["0.9.35"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"froxlor","fixed_in":["0.10.23-lp152.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"froxlor","fixed_in":["0.10.23-bp152.4.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"froxlor/froxlor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.35"}]}]},{"source":"osv","ecosystem":"Packagist","package":"froxlor/froxlor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.35"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"froxlor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.23-lp152.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"froxlor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.23-bp152.4.3.1"}]}]}],"products":[{"vendor":"froxlor","product":"froxlor"}],"references":[{"url":"https://github.com/Froxlor/Froxlor/commit/da4ec3e1b591de96675817a009e26e05e848a6ba","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5100","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qj6h-m7xc-r2v3"},{"url":"https://github.com/Froxlor/Froxlor","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AAUIVTQVXK6DU6ZXURWINSWBU3EBTIT7/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1025193","tags":["report"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/846355","tags":["report"]},{"url":"https://bugzilla.suse.com/958100","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5100","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7YQHL4MI6XNUZ25CJOTEP4PACP46MIOF/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-5100","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","status":"published","published":"2017-02-13T18:00:00Z","modified":"2024-08-06T00:53:47.285Z","updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2022-4985","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","status":"published","published":"2017-02-13T18:00:00Z","modified":"2024-08-06T00:53:47Z","updated_at":"2026-11-03T02:22:43.529102Z"}],"ghsa":[{"id":"GHSA-qj6h-m7xc-r2v3","title":"Froxlor guessable password reset token","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","status":"published","published":"2022-05-17T02:57:53Z","modified":"2024-04-25T21:22:16Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:37:46.667202Z"}],"nvd":[{"id":"CVE-2016-5100","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","status":"published","published":"2017-02-13T18:59:00.627Z","modified":"2026-06-17T00:48:45.75Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-5100","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","status":"published","published":"2017-02-13T18:59:00.627Z","modified":"2026-10-20T10:47:30.215863812Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"GHSA-qj6h-m7xc-r2v3","title":"Froxlor guessable password reset token","description":"Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.","status":"published","published":"2022-05-17T02:57:53Z","modified":"2024-04-25T21:43:27.390696Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-330"],"updated_at":"2026-11-02T15:46:54.760124Z"},{"id":"openSUSE-SU-2021:0415-1","title":"Security update for froxlor","description":"This update for froxlor fixes the following issues:\n\n- Upstream upgrade to version 0.10.23 (boo#846355)\n- Upstream upgrade to version 0.10.22 (boo#846355)\n\n- BuildRequire cron as this contains now the cron directories\n- Use %license for COPYING file instead of %doc [boo#1082318]\n\nUpstream upgrade to version 0.9.40.1 (boo#846355)\n\nnew features besides API that found their way in:\n\n- 2FA / TwoFactor Authentication for accounts\n- MySQL8 compatibility\n- new implementation of Let's Encrypt (acme.sh)\n- customizable error/access log handling for webserver (format, level, pipe-to-script, etc.)\n- lots and lots of bugfixes and small enhancements\n\nUpstream upgrade to version 0.9.39.5 (boo#846355)\n\n- PHP rand function for random number generation fixed in previous\n  version (boo#1025193) CVE-2016-5100\n- upstream upgrade to version 0.9.39 (boo#846355)\n- Add and change of froxlor config files and manual\n- Change Requires to enable use with php7","status":"published","published":"2021-03-16T13:05:56Z","modified":"2026-02-04T04:14:15.230168Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0450-1","title":"Security update for froxlor","description":"This update for froxlor fixes the following issues:\n\n- Upstream upgrade to version 0.10.23 (boo#846355)\n- Upstream upgrade to version 0.10.22 (boo#846355)\n\n- BuildRequire cron as this contains now the cron directories\n- Use %license for COPYING file instead of %doc [boo#1082318]\n\nUpstream upgrade to version 0.9.40.1 (boo#846355)\n\nnew features besides API that found their way in:\n\n- 2FA / TwoFactor Authentication for accounts\n- MySQL8 compatibility\n- new implementation of Let's Encrypt (acme.sh)\n- customizable error/access log handling for webserver (format, level, pipe-to-script, etc.)\n- lots and lots of bugfixes and small enhancements\n\nUpstream upgrade to version 0.9.39.5 (boo#846355)\n\n- PHP rand function for random number generation fixed in previous\n  version (boo#1025193) CVE-2016-5100\n- upstream upgrade to version 0.9.39 (boo#846355)\n- Add and change of froxlor config files and manual\n- Change Requires to enable use with php7\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-03-19T19:05:59Z","modified":"2026-02-04T03:23:00.420816Z","updated_at":"2026-11-02T16:58:31.879684Z"}]}}