CVE-2021-27913GHSA-X7G2-WRRP-R6H3
Use of a Broken or Risky Cryptographic Algorithm
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.3.4, 4.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0.
Timeline
- CVE published
- Record last updated
Affected versions
- Mautic Mautic
fixed in 3.3.4; fixed in 4.0.0
- mautic/corePackagist
fixed in 3.3.4
- mautic/corePackagist
From 4.0.0-alpha1 · fixed in 4.0.0