Lucene search

K

Veracode Vulnerability DatabaseVERACODE:35596

HistoryMay 19, 2022 - 3:54 a.m.

Information Disclosure

2022-05-1903:54:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

11

information disclosure

random_password_generator

insecure generation

rand functionality

guess password

EPSS

0.002

Percentile

60.0%

random_password_generator is vulnerable to information disclosure. The vulnerability exists due to the insecure random password generation in rand functionality in the generate function of random_password_generator.rb, allowing an attacker to guess the password.

References

github.com/advisories/GHSA-ggfx-h9xj-5v9c

github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23

github.com/bvsatyaram/random_password_generator/commit/5adce57d0e7ed171738ee94d2b7f1e5f18c863a8

github.com/bvsatyaram/random_password_generator/pull/1

ruby-doc.org/core-3.1.2/Random.html

stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560

EPSS

0.002

Percentile

60.0%

Related for VERACODE:35596

cvelist1 osv2 nvd1 prion1 github1 rubygems1 cve1