Description
SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 uses weak entropy when generating tokens for (1) the CSRF protection mechanism, (2) autologin, (3) "forgot password" functionality, and (4) password salts, which makes it easier for remote attackers to bypass intended access restrictions via unspecified vectors.
Remediation
References
Related Vulnerabilities
MySQL CVE-2017-3265 Vulnerability (CVE-2017-3265)
WordPress Plugin FooBox Image Lightbox Security Bypass (2.6.3)
WordPress Plugin Yoast SEO Cross-Site Scripting (21.0)
Oracle Application Server CVE-2008-3986 Vulnerability (CVE-2008-3986)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3390)