Vulnerabilities > CVE-2019-10908 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Airsonic Project Airsonic 10.2.1
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |