CVE-2021-22948

2021-09-2312:44:20

CWE-79

hackerone

www.cve.org

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function. Under some circumstances, an attacker could theoretically be able to brute force session IDs in order to take over a specific account.

CNA Affected

[
  {
    "product": "https://github.com/revive-adserver/revive-adserver",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed version v5.3.0"
      }
    ]
  }
]