Vulnerabilities > CVE-2023-4472 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Objectplanet Opinio

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

objectplanet

CWE-335

critical

NVD

Published: 2024-02-01

Updated: 2024-02-09

Summary

Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

Vulnerable Configurations

Part	Description	Count
Application	Objectplanet Objectplanet Opinio 4.0 Objectplanet Opinio 4.0.1 Objectplanet Opinio 4.0.2 Objectplanet Opinio 4.1 Objectplanet Opinio 4.1.1 Objectplanet Opinio 4.1.2 Objectplanet Opinio 4.1.3 Objectplanet Opinio 4.1.4 Objectplanet Opinio 4.2 Objectplanet Opinio 4.2.1 Objectplanet Opinio 4.2.2 Objectplanet Opinio 4.3 Objectplanet Opinio 4.3.1 Objectplanet Opinio 4.3.2 Objectplanet Opinio 4.3.3 Objectplanet Opinio 4.3.4 Objectplanet Opinio 4.3.5 Objectplanet Opinio 4.3.6 Objectplanet Opinio 4.3.7 Objectplanet Opinio 4.3.8 Objectplanet Opinio 4.3.9 Objectplanet Opinio 4.3.10 Objectplanet Opinio 4.3.11 Objectplanet Opinio 5.0 Objectplanet Opinio 5.01 Objectplanet Opinio 5.1 Objectplanet Opinio 5.02 Objectplanet Opinio 5.2 Objectplanet Opinio 5.2.1 Objectplanet Opinio 5.2.2 Objectplanet Opinio 5.2.3 Objectplanet Opinio 5.2.4 Objectplanet Opinio 5.2.5 Objectplanet Opinio 5.2.6 Objectplanet Opinio 5.2.7 Objectplanet Opinio 5.2.8 Objectplanet Opinio 5.2.9 Objectplanet Opinio 5.2.10 Objectplanet Opinio 5.2.11 Objectplanet Opinio 5.2.12 Objectplanet Opinio 6.0 Objectplanet Opinio 6.0.1 Objectplanet Opinio 6.0.2 Objectplanet Opinio 6.0.3 Objectplanet Opinio 6.0.4 Objectplanet Opinio 6.0.5 Objectplanet Opinio 6.0.6 Objectplanet Opinio 6.0.7 Objectplanet Opinio 6.0.8 Objectplanet Opinio 6.1 Objectplanet Opinio 6.2.1 Objectplanet Opinio 6.2.2 Objectplanet Opinio 6.3 Objectplanet Opinio 6.3.1 Objectplanet Opinio 6.3.2 Objectplanet Opinio 6.3.3 Objectplanet Opinio 6.4 Objectplanet Opinio 6.4.1 Objectplanet Opinio 6.4.2 Objectplanet Opinio 6.4.3 Objectplanet Opinio 6.4.4 Objectplanet Opinio 6.5 Objectplanet Opinio 6.5.1 Objectplanet Opinio 6.6 Objectplanet Opinio 6.6.1 Objectplanet Opinio 6.6.2 Objectplanet Opinio 6.6.3 Objectplanet Opinio 6.7 Objectplanet Opinio 6.7.1 Objectplanet Opinio 6.7.2 Objectplanet Opinio 6.8 Objectplanet Opinio 6.8.1 Objectplanet Opinio 6.8.2 Objectplanet Opinio 6.9 Objectplanet Opinio 6.9.1 Objectplanet Opinio 7.0 Objectplanet Opinio 7.1 Objectplanet Opinio 7.1.1 Objectplanet Opinio 7.1.2 Objectplanet Opinio 7.2 Objectplanet Opinio 7.2.1 Objectplanet Opinio 7.3 Objectplanet Opinio 7.4 Objectplanet Opinio 7.4.1 Objectplanet Opinio 7.4.2 Objectplanet Opinio 7.4.3 Objectplanet Opinio 7.5 Objectplanet Opinio 7.6 Objectplanet Opinio 7.6.1 Objectplanet Opinio 7.6.2 Objectplanet Opinio 7.6.3 Objectplanet Opinio 7.6.4 Objectplanet Opinio 7.6.5 Objectplanet Opinio 7.7 Objectplanet Opinio 7.7.1 Objectplanet Opinio 7.7.2 Objectplanet Opinio 7.8 Objectplanet Opinio 7.9 Objectplanet Opinio 7.9.1 Objectplanet Opinio 7.10 Objectplanet Opinio 7.11 Objectplanet Opinio 7.12 Objectplanet Opinio 7.13 Objectplanet Opinio 7.14 Objectplanet Opinio 7.15 Objectplanet Opinio 7.16 Objectplanet Opinio 7.17 Objectplanet Opinio 7.18 Objectplanet Opinio 7.19 Objectplanet Opinio 7.20 Objectplanet Opinio 7.21 Objectplanet Opinio 7.22	129

Common Weakness Enumeration (CWE)

CWE-335 - Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References