CRITICAL🇵🇱 Wersja polska

CVE-2019-10908

CVSS 9.8v3.0pub. 2019-04-07upd. 2024-11-21

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Airsonic Project Airsonic

    APP
    Airsonic Project
    10.2.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
References

Related vulnerabilities

CVE-2019-10907CRITICAL9.8PL ✓same product

Airsonic: słabe szyfrowanie mechanizmu remember-me umożliwia odzyskanie haseł

CVE-2018-20222CRITICAL9.8PL ✓same product

XXE w Airsonic — zdalne odczytanie plików przed wersją 10.1.2