PT-2018-14498 · Kaptcha · Kaptcha

Fanjun Meng · Publicado 2018-10-19 · Atualizado 2019-01-25 · CVE-2018-18531

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kaptcha version 2.3.2

Description The issue allows remote attackers to bypass intended access restrictions via a brute-force approach due to the use of the Random function instead of SecureRandom for generating CAPTCHA values in certain Java classes.

Recommendations For kaptcha version 2.3.2, consider updating the DefaultTextCreator.java, ChineseTextProducer.java, and FiveLetterFirstNameTextCreator.java classes to use SecureRandom instead of Random for generating CAPTCHA values to prevent brute-force attacks.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2018-18531

GHSA-8Q89-PWHH-7WFQ

Produtos afetados

Kaptcha

Referências · 6

• https://github.com/penggle/kaptcha/issues/3 · Nota
• https://github.com/penggle/kaptcha · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18531 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18531 · Aviso do Fabricante
• https://github.com/advisories/GHSA-8q89-pwhh-7wfq · Nota
• https://osv.dev/vulnerability/GHSA-8q89-pwhh-7wfq · Aviso do Fabricante