« Volver al listado

CVE-2010-4728

Estado: ModificadaMedia (5)—

Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which makes it easier for remote attackers to defeat protection mechanisms based on randomization by predicting a return value, as demonstrated by the authid protection mechanism.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zikula — Zikula Application Framework

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-4728",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-02-08T22:00:00.883",
  "references": [
    {
      "url": "http://code.zikula.org/core/ticket/2009",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://code.zikula.org/core/ticket/2009",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zikula before 1.3.1 uses the rand and srand PHP functions for random number generation, which makes it easier for remote attackers to defeat protection mechanisms based on randomization by predicting a return value, as demonstrated by the authid protection mechanism."
    },
    {
      "lang": "es",
      "value": "Zikula en versiones anteriores a la 1.3.1 utiliza las funciones PHP rand y srand para la generación de números aleatorios, lo que facilita a atacantes remotos evitar los mecanismos de protección basados en la aleatorización prediciendo el valor de rotorno, como se ha demostrado con el mecanismo de protección authid."
    }
  ],
  "lastModified": "2026-06-16T23:25:25.920",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53BBBEBB-3CBD-4650-91C4-8DD0CE3C6B78",
              "versionEndIncluding": "1.2.5"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F1B6758-3E03-412F-84BD-83C8B669F738"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CB69408-9D6A-475F-BB4B-E5F52465FE42"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A76E5B1A-8CD3-40E6-B491-81F7D8B8F86A"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6EE3D78-D9A4-4CC3-A242-232CA58C6B68"
            },
            {
              "criteria": "cpe:2.3:a:zikula:zikula_application_framework:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "152E4A65-5432-4CAE-98CE-44CDD48AB6E7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}