CVE-2026-38447

Katalog CVE

CVSS 9.8 · Critical EPSS 0,67%

Kerentanan Insufficient Entropy. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the key space within a feasible time window.

Rincian

Terbit di NVD

3 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-331: Insufficient Entropy

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/fr3akhacks/cve-disclosures/blob/master/osTicket/CVE-2026-38447.md
• https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.api.php#L149
• https://github.com/osTicket/osTicket/blob/v1.18.3/include/class.misc.php
• https://github.com/osTicket/osTicket/commit/feccb6a3a90863fd31215ee738b39762177e658c