CVE-2021-27913CWE-327

Use of a Broken or Risky Cryptographic Algorithm

Low · published August 30, 2021

CVSS v3.1
3.5
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.8th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2021-08-30T15:55Z
EPSS history
Timeline
  • 30 AUG 15:55Z
    Use of a Broken or Risky Cryptographic Algorithm
    cvelistv5