Описание
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
Ссылки
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:magento:magento2:-:*:*:*:*:*:*:*
EPSS
Процентиль: 15%
0.00047
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-327
Связанные уязвимости
CVSS3: 7.5
github
около 6 лет назад
Unauthenticated crypto and weak IV in Magento\Framework\Encryption
EPSS
Процентиль: 15%
0.00047
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-327