CVE-2024-29868

Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism.This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account.This issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Affected

Apache Software Foundation · Apache StreamPipes

CVSS v4.0 GitHub

9.1 CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS v3.1 CNA

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

6.00% chance of exploitation in the next 30 days, 93rd percentile

Nuclei

critical · CWE-338

Published

2024-06-24

Updated

2024-09-13

Proof-of-concept exploits (1)

• DEVisions/CVE-2024-298681★ · 2024-06-24

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29868.yaml

Security advisories

• https://lists.apache.org/thread/g7t7zctvq2fysrw1x17flnc12592nhx7
• http://www.openwall.com/lists/oss-security/2024/06/22/1
• advisories/GHSA-cf3q-vg8w-mw84

References

• CVE Record
• NVD entry