| शीर्षक | diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad Cryptographically Weak PRNG |
|---|
| विवरण | `dmCorePlugin/lib/basic/dmString.php` implements `dmString::random()` by repeatedly calling PHP `rand()`. The password-reset action in `dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php` uses a 12-character value from this function as a bearer `forgot_password_code`, and the persistent-login path in `dmSecurityUser.class.php` derives its remembered-login key from the same output. The reset handler accepts the code to set a new password, while `dmRememberMeFilter` authenticates a request based on a matching key. These account-authentication tokens are generated by a non-cryptographic PRNG rather than a CSPRNG, so deployments where an attacker can predict or recover the PRNG state are exposed to account takeover. |
|---|
| स्रोत | ⚠️ https://github.com/diem-project/diem/issues/458 |
|---|
| उपयोगकर्ता | cnluminous (UID 98136) |
|---|
| सबमिशन | 30/09/2026 06:06 PM (19 दिन पहले) |
|---|
| संयम | 18/10/2026 11:52 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421689 [diem-project diem तक 116974edfb9a5b8bd69cb13586dc62bcdbb485ad dmString.php dmString::random कमजोर एन्क्रिप्शन] |
|---|
| अंक | 20 |
|---|