CVE Daily

CVE-2010-1128

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide th...

Medium CVSS 6.4

Overview

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.

CWE: CWE-310 Published: 2010-03-26T20:30:00.877
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 6.4 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags