Vulnerability Description
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Acquia | Mautic | < 3.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/mautic/mautic/security/advisories/GHSA-x7g2-wrrp-r6h3ExploitPatchThird Party Advisory
- https://github.com/mautic/mautic/security/advisories/GHSA-x7g2-wrrp-r6h3ExploitPatchThird Party Advisory
FAQ
What is CVE-2021-27913?
CVE-2021-27913 is a vulnerability with a CVSS score of 3.5 (LOW). The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically...
How severe is CVE-2021-27913?
CVE-2021-27913 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27913?
Check the references section above for vendor advisories and patch information. Affected products include: Acquia Mautic.