« Volver al listado

CVE-2023-4472

Estado: ModificadaCrítica (9.8)—

Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Objectplanet — Opinio

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-4472",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-4472",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-21T19:37:11.901532Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "mandiant-cve@google.com",
      "affectedData": [
        {
          "vendor": "Objectplanet",
          "product": "Opinio",
          "versions": [
            {
              "status": "affected",
              "version": "7.22"
            },
            {
              "status": "unaffected",
              "version": "7.23"
            }
          ],
          "platforms": [
            "All",
            "Cloud",
            "Browser"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-02-01T22:15:55.220",
  "references": [
    {
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://www.objectplanet.com/opinio/changelog.html",
      "tags": [
        "Release Notes"
      ],
      "source": "mandiant-cve@google.com"
    },
    {
      "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.objectplanet.com/opinio/changelog.html",
      "tags": [
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "mandiant-cve@google.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-335"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-335"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application."
    },
    {
      "lang": "es",
      "value": "Objectplanet Opinio versión 7.22 y anteriores utiliza un generador de números pseudoaleatorios (PRNG) criptográficamente débil acoplado a una semilla predecible, lo que podría conducir a una apropiación no autenticada de la cuenta de cualquier usuario de la aplicación."
    }
  ],
  "lastModified": "2026-06-17T06:37:54.370",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:objectplanet:opinio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A09C2A9-4E46-4B49-AC57-DEFD7E693093",
              "versionEndExcluding": "7.23"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "mandiant-cve@google.com"
}