CVE-2019-10908 - In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally

Back Back to CVE browser

CRITICAL

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally

Published Apr 7, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 1.61%

Description

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses java.util.Random internally. This PRNG has a 48-bit seed that can easily be bruteforced, leading to trivial privilege escalation attacks.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-335

References (1)

https://github.com/airsonic/airsonic/commit/61c842923a6d60d4aedd126445a8437b53b752c8
x_refsource_MISCPatchThird Party Advisory

Link	Providers	Tags
https://github.com/airsonic/airsonic/commit/61c842923a6d60d4aedd126445a8437b53b752c8		x_refsource_MISCPatchThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 7, 2019

Updated Aug 4, 2024

Reserved Apr 7, 2019

Link CVE-2019-10908

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-10908

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-10908