PT-2018-14498 · Kaptcha · Kaptcha

Fanjun Meng · Published 2018-10-19 · Updated 2019-01-25 · CVE-2018-18531

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kaptcha version 2.3.2

Description The issue allows remote attackers to bypass intended access restrictions via a brute-force approach due to the use of the Random function instead of SecureRandom for generating CAPTCHA values in certain Java classes.

Recommendations For kaptcha version 2.3.2, consider updating the DefaultTextCreator.java, ChineseTextProducer.java, and FiveLetterFirstNameTextCreator.java classes to use SecureRandom instead of Random for generating CAPTCHA values to prevent brute-force attacks.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2018-18531

GHSA-8Q89-PWHH-7WFQ

Affected Products

Kaptcha

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-18531 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18531 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8q89-pwhh-7wfq · Vendor Advisory
• https://github.com/penggle/kaptcha/issues/3 · Note
• https://github.com/penggle/kaptcha · Note
• https://github.com/advisories/GHSA-8q89-pwhh-7wfq · Note