WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword() to create passwords using PHPs rand(). rand() is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege escalation if these passwords are used for new accounts or password resets. The vulnerability is fixed in version 1.6.5.
Weakness
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Wbce_cms | Wbce | * | 1.6.5 (excluding) |
Potential Mitigations
Related Attack Patterns
References
- https://cwe.mitre.org/data/definitions/338.html
- https://github.com/WBCE/WBCE_CMS/commit/5d59fe021a5c6e469b1bf192b72ca652e54278f6
- https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.5
- https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6
- https://github.com/WBCE/WBCE_CMS/security/advisories/GHSA-76gj-pmvx-jcc6