Lookup for vulnerable packages by Package URL.
| Purl | pkg:composer/zendframework/zend-captcha@2.1.6 |
|---|
| Type | composer |
|---|
| Namespace | zendframework |
|---|
| Name | zend-captcha |
|---|
| Version | 2.1.6 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 2.4.9 |
|---|
| Latest_non_vulnerable_version | 2.5.2 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-5cz1-j5rs-dub8 |
| vulnerability_id |
VCID-5cz1-j5rs-dub8 |
| summary |
Potential Information Disclosure and Insufficient Entropy in Zend\Captcha\Word
Zend generates a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. The selection is performed using PHP's internal `array_rand()` function. This function does not generate sufficient entropy due to its usage of `rand()` instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This can potentially lead to information disclosure should an attacker be able to brute force the random number generation. |
| references |
|
| fixed_packages |
|
| aliases |
GMS-2015-47
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5cz1-j5rs-dub8 |
|
| 1 |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:composer/zendframework/zend-captcha@2.1.6 |
|---|