CVSS 6.5 · Medium EPSS 1,6%
Kerentanan Generation of Predictable IV with CBC Mode pada pivotal software spring security, vmware spring security. Skor CVSS 3.1 6.5 (Medium) menurut NVD.
Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| pivotal software | spring security | Versi 5.2.0 hingga sebelum 5.2.4 |
| pivotal software | spring security | Versi 5.3.0 hingga sebelum 5.3.2 |
| vmware | spring security | Versi 4.2.0 hingga sebelum 4.2.16 |
| vmware | spring security | Versi 5.0.0 hingga sebelum 5.0.16 |
| vmware | spring security | Versi 5.1.0 hingga sebelum 5.1.10 |