PT-2024-13199 · Objectplanet · Objectplanet Opinio

Amine Ismail · Published 2024-02-01 · Updated 2024-02-09 · CVE-2023-4472

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Objectplanet Opinio versions 7.22 and prior

Description The issue is related to the use of a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

Recommendations For Objectplanet Opinio versions 7.22 and prior, update to a version that uses a cryptographically secure pseudo-random number generator to prevent unauthenticated account takeover. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-335

Related Identifiers

CVE-2023-4472

Affected Products

Objectplanet Opinio

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-4472 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4472 · Vendor Advisory
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md · Note
• https://t.me/cvenotify/69643 · Telegram Post
• https://t.me/cvenotify/69636 · Telegram Post
• https://objectplanet.com/opinio/changelog.html · Note
• https://twitter.com/VulmonFeeds/status/1753206093130420623 · Twitter Post
• https://twitter.com/CVEnew/status/1753183832809885729 · Twitter Post
• https://t.me/cvenotify/70872 · Telegram Post