GitHub Advisoryadvisory · Maven

GHSA-4c72-mrhf-23cg Apache Syncope uses a weak PNRG

MEDIUM Published 2022-05-14 Modified 2023-08-15 Official page ↗
Aliases
CVE-2014-3503
Ecosystem
Maven
Packages
org.apache.syncope:syncope
Severity
Moderate
Weaknesses
CWE-338
Reviewed
2023-08-15

Affected packages

• Maven org.apache.syncope:syncope: >= 1.1.0, < 1.1.8 → fixed in 1.1.8

Description

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Related

Alias · CVE (1)

  • CVE-2014-3503 Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the… vulnerability

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References