地图 / Use of a Broken or Risky Cryptographic Algorithm

Use of a Broken or Risky Cryptographic Algorithm

密码学缺陷 / Use of a Broken or Risky Cryptographic Algorithm / #1306942

厂商: Revive Adserver
严重程度: 低危
赏金: —
弱点: Use of a Broken or Risky Cryptographic Algorithm
研究员: @418sec
披露日期: 2021-09-15
资产: https://github.com/revive-adserver/revive-adserver
CVE: CVE-2021-22948

该报告还没有中文解读。

原文摘录

摘自原文（699 字符中的一小部分）

revive-adserver utilizes a PRNG for session-token generation, this means that an attacker could theoretically be able to generate session tokens at random and take over accounts at random.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Revive Adserver 所有。

时间线

2021-08-16报告提交
2021-09-15公开披露

阅读 HackerOne 原文 ↗作者 @418sec · 版权归作者与 Revive Adserver 所有

同类报告

0 Click account takeover via timed requests to ███████forgot-password (single-packet attack)Mars · 2024-07-11 iOS group chat denial of serviceLY Corporation · 2023-03-29 · $300 Invisible Salamanders Attack against end_to_end_encryption in NextcloudNextcloud · 2024-12-03 Weak ssh algorithms and CVE-2023-48795 Discovered on various subdomains of nextcloud.comNextcloud · 2024-05-22 Default Minimum TLS Version Set to TLS v1.0 (Cryptographic Weakness)curl · 2025-07-10 Use of a Broken or Risky Cryptographic Algorithm (CWE-327) in libcurlcurl · 2025-04-29