PT-2014-2423

CVE-2012-6661

Published

2014-11-03

Updated

2018-07-23

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1

Description The issue makes it easier for remote attackers to guess the value of the pseudo-random number generator (PRNG) via unspecified vectors, due to the PRNG not being reseeded.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone versions 4.3 before beta 1, update to beta 1 or later.

Exploitability

Exploit

Fix

Researchers

Christian Heimes

Vendors

Affected products

Weakness enumeration

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)

CWE-310

Related identifiers

CVE-2012-6661