PT-2023-25765 · Travianz · Travianz

Bram · Publicado 2023-07-07 · Atualizado 2023-07-13 · CVE-2023-36993

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TravianZ versions 8.3.3 through 8.3.4

Description The issue arises from a cryptographically insecure random number generator used in the password reset function, allowing an attacker to guess the password reset parameters and take over accounts.

Recommendations For versions 8.3.3 and 8.3.4, consider disabling the password reset function until a secure random number generator is implemented. As a temporary workaround, restrict access to the password reset feature to minimize the risk of account takeover. Avoid using the password reset function in the affected versions until the issue is resolved with a secure random number generator implementation.

Exploit

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2023-36993

Produtos afetados

Travianz

Referências · 5

• 🔥 https://bramdoessecurity.com/travianz-hacked · Exploit
• https://t.me/cvenotify/54296 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-36993 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36993 · Nota de Segurança
• https://t.me/cibsecurity/66228 · Publicação no Telegram