CVE-2022-0828

Katalog CVE

CVSS 7.5 · High EPSS 1,5%

Kerentanan Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) pada w3eden download manager. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

Rincian

Terbit di NVD

11 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/7f0742ad-6fd7-4258-9e44-d42e138789bb exploit · advisory pihak ketiga