Privilege escalation

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks...

CVE-2019-10908

In Airsonic 10.2.1, RecoverController.java generates passwords using org.apache.commons.lang.RandomStringUtils, which relies on java.util.Random. The underlying PRNG has a 48-bit seed that can be brute-forced, enabling trivial privilege escalation. Affected component: RecoverController/password g...

CVE-2019-10908: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks...