Values produced by ${random.value} are not suitable for use as secrets.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.0.6, 3.5.14, 3.4.16, 3.3.19, 2.7.33
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Spring Spring Boot
From 4.0.0 · fixed in 4.0.6; From 3.5.0 · fixed in 3.5.14; From 3.4.0 · fixed in 3.4.16; From 3.3.0 · fixed in 3.3.19; From 2.7.0 · fixed in 2.7.33
- org.springframework.boot:spring-boot-cassandraMaven
From 4.0.0 · fixed in 4.0.6
- org.springframework.boot:spring-boot-cassandraMaven
From 3.5.0 · fixed in 3.5.14
- org.springframework.boot:spring-boot-cassandraMaven
From 3.4.0 · through 3.4.15
- org.springframework.boot:spring-boot-cassandraMaven
From 3.3.0 · through 3.3.18
- org.springframework.boot:spring-boot-cassandraMaven
through 2.7.32