PT-2025-43415 · Sakai · Sakai

Published 2025-10-22 · Updated 2025-10-30 · CVE-2025-62710

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sakai versions prior to 23.5 Sakai versions prior to 25.0

Description Sakai is a Collaboration and Learning Environment. The EncryptionUtilityServiceImpl component initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random, which is a non-cryptographic pseudo-random number generator (PRNG). This PRNG can be predicted from limited state or seed information, reducing the effectiveness of the generated key. An attacker obtaining ciphertexts may be able to reconstruct the serverSecretKey and decrypt affected data.

Recommendations Update to Sakai version 23.5 or later. Update to Sakai version 25.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-337

Related Identifiers

CVE-2025-62710

GHSA-GR7H-XW4F-WH86

Affected Products

Sakai

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62710.json · Exploit
• https://github.com/sakaiproject/sakai/security/advisories/GHSA-gr7h-xw4f-wh86 · Vendor Advisory
• https://github.com/sakaiproject/sakai/commit/bde070104b1de01f4a6458dca6d9e0880a0e3c04 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62710 · Security Note
• https://osv.dev/vulnerability/GHSA-gr7h-xw4f-wh86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62710 · Vendor Advisory
• https://github.com/sakaiproject/sakai · Note
• https://t.me/cveNotify/141003 · Telegram Post
• https://t.me/cveNotify/139962 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1981241158580769064 · Twitter Post
• https://t.me/CVEtracker/35532 · Telegram Post
• https://twitter.com/CVEnew/status/1981219893404995769 · Twitter Post