What is GHSA-8q89-pwhh-7wfq?

GHSA-8q89-pwhh-7wfq is a security advisory published by GitHub Security Advisories with Critical severity. Use of Insufficiently Random Values in penggle:kaptcha

Which CVE IDs does GHSA-8q89-pwhh-7wfq cover?

GHSA-8q89-pwhh-7wfq covers the following CVE IDs: CVE-2018-18531. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8q89-pwhh-7wfq?

GHSA-8q89-pwhh-7wfq has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-8q89-pwhh-7wfq?

GHSA-8q89-pwhh-7wfq affects 1 product, including: maven/com.github.penggle:kaptcha:\u003c= 2.3.2.

GHSA-8q89-pwhh-7wfqCriticalCVSS 9.8

Use of Insufficiently Random Values in penggle:kaptcha

Vendor

GitHub Security Advisories

Published

October 23, 2018

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-18531 →

📋 Description

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach.

🎯 Affected products1

maven/com.github.penggle:kaptcha:<= 2.3.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-18531
https://github.com/penggle/kaptcha/issues/3
https://github.com/advisories/GHSA-8q89-pwhh-7wfq