CVE-2025-67504
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wbce | cms | 1.6.4 |
| wbce | wbce_cms | to 1.6.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-331 | The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. |
| CWE-338 | The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WBCE CMS versions 1.6.4 and below, where the function GenerateRandomPassword() uses PHP's rand() function to create passwords. Since rand() is not cryptographically secure, the generated passwords can be predicted or brute-forced, making it easier for attackers to compromise user accounts or escalate privileges.
How can this vulnerability impact me? :
The vulnerability can lead to user account compromise or privilege escalation if the predictable passwords are used for new accounts or password resets, potentially allowing unauthorized access to the system.
What immediate steps should I take to mitigate this vulnerability?
Upgrade WBCE CMS to version 1.6.5 or later, as this version fixes the vulnerability related to the insecure use of PHP's rand() function in password generation. Avoid using affected versions (1.6.4 and below) for new accounts or password resets until upgraded.