CVE-2024-29868

Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

State: Published
Severity: 9.1 Critical
Published: Jun 24, 2024
Updated: Sep 13, 2024
Reserved: Mar 21, 2024

Read the record on cve.org

Description

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.

Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Affected Products

Product	Versions
Apache StreamPipesApache Software Foundation	0.69.0 through 0.93.0Affected
Apache StreamPipesApache Software Foundation	0.69.0 through 0.93.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.