CVE-2023-4472 Cryptographically weak PRNG in Opinio 7.22

2024-02-0122:11:21

CWE-335

Mandiant

github.com

cve-2023-4472; cryptographically weak; prng; opinio 7.22; account takeover; unauthenticated; application

AI Score

6.9

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

CNA Affected

[
  {
    "vendor": "Objectplanet",
    "product": "Opinio",
    "versions": [
      {
        "status": "affected",
        "version": "7.22"
      },
      {
        "status": "unaffected",
        "version": "7.23"
      }
    ],
    "platforms": [
      "All",
      "Cloud",
      "Browser"
    ],
    "defaultStatus": "affected"
  }
]