CVE-2016-6485 in Magento

Tóm tắt

Bởi MITRE

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Đặt trước: 27/07/2016
• Tiết lộ: 01/03/2017
• Kiểm duyệt: được chấp nhận
• mục: VDB-97400
• CPE: sẵn sàng
• CWE: CWE-327 (Đã xác nhận)
• CVSS: 7.5 (NVD)
• EPSS: 0.00846
• KEV: không
• Các hoạt động: rất thấp

Nguồn

• MITRE: https://www.cve.org/CVERecord?id=CVE-2016-6485
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-6485
• CVE Details: https://www.cvedetails.com/cve/CVE-2016-6485/