Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. mautic/core
  4. ›
  5. CVE-2021-27913

CVE-2021-27913: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

August 30, 2021 (updated September 3, 2021)

The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic ;

References

  • nvd.nist.gov/vuln/detail/CVE-2021-27913

Code Behaviors & Features

Detect and mitigate CVE-2021-27913 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.3.4, version 4.0.0

Fixed versions

  • 3.3.4

Solution

Upgrade to version 3.3.4 or above.

Impact 3.5 LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Learn more about CVSS

Source file

packagist/mautic/core/CVE-2021-27913.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:07 +0000.