Vulnerability Details : CVE-2023-2884
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Published
2023-05-25 09:15:12
Updated
2023-08-02 17:15:56
Products affected by CVE-2023-2884
- cpe:2.3:a:cbot:cbot_panel:*:*:*:*:*:*:*:*
- cpe:2.3:a:cbot:cbot_core:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-2884
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 14 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-2884
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
Computer Emergency Response Team of the Republic of Turkey | |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2023-2884
-
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.Assigned by: cve@usom.gov.tr (Primary)
-
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.Assigned by: cve@usom.gov.tr (Primary)
References for CVE-2023-2884
-
https://www.usom.gov.tr/bildirim/tr-23-0293
Ulusal Siber Olaylara Müdahale Merkezi - USOMThird Party Advisory
Jump to