CVE Feed

    Dashboard / CVE / CVE-2021-27913

    CVE-2021-27913

    The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0.

    Published:Aug 30, 2021
    Last Modified:Nov 21, 2024
    EPS:Aug 30, 2021
    EPSS Score:0.00089
    CVSS Score:3.5

    Affected Products

    Vendor
    Acquia
    Product
    Mautic

    Exploits

    https://github.com/mautic/mautic/security/advisories/GHSA-x7g2-wrrp-r6h3https://github.com/mautic/mautic/security/advisories/GHSA-x7g2-wrrp-r6h3

    Related CVEs

    CVE-2026-3105 (CVSS 7.6) — SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact a…
    CVE-2024-47055 (CVSS 4.3) — SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality…
    CVE-2024-47051 (CVSS 9.1) — This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These v…
    CVE-2024-47053 (CVSS 7.7) — This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. T…
    CVE-2022-25773 (CVSS 4.3) — This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended di…
    CVE-2022-25770 (CVSS 7.8) — Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off corre…
    CVE-2024-47059 (CVSS 4.3) — When logging in with the correct username and incorrect weak password, the user receives the notification, tha…
    CVE-2021-27917 (CVSS 7.3) — Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.…
    CVE-2024-47050 (CVSS 5.4) — Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page U…
    CVE-2024-47058 (CVSS 2.9) — With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This co…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High