PT-2014-2423

CVE-2012-6661

Publicado

2014-11-03

Atualizado

2018-07-23

Descrição por

CVSS 4.0

8.7

Alta

MétricasAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue makes it easier for remote attackers to guess the value of the pseudo-random number generator (PRNG) via unspecified vectors, due to the PRNG not being reseeded.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later.

Explorabilidade

Exploit

Correção

Pesquisadores

Christian Heimes

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)

CWE-310

Identificadores relacionados

CVE-2012-6661