CVE-2021-4240: Insufficient Entropy in PHPServerMon PRNG
Summary
CVE-2021-4240: Insufficient Entropy in PHPServerMon PRNG. Affects phpservermon/phpservermon versions < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHPServerMon is an open-source monitoring tool written in PHP. It is designed to monitor the status and performance of servers, services, and network devices. The vulnerability identified in PHPServerMon is related to the function generatePasswordResetToken in the User.php file. This function uses a predictable algorithm in the random number generator, leading to insufficient entropy. This vulnerability has been assigned the identifier VDB-213717 and has a CVSS score of 5.3.
Vulnerability Detail
The vulnerability in PHPServerMon allows an attacker to predict the password reset tokens generated by the generatePasswordResetToken function. This can potentially lead to unauthorized access to user accounts and sensitive information. The vulnerability has been publicly disclosed and the exploit may be used by malicious actors. The recommended patch for this vulnerability is 3daa804d5f56c55b3ae13bfac368bb84ec632193.
How To Fix
Minimum fixed version
3.6.0
This is the first release that contains the fix.
composer require phpservermon/phpservermon:3.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in PHPServerMon's generatePasswordResetToken function poses a risk of unauthorized access to user accounts and sensitive information. It is crucial to apply the recommended patch (3daa804d5f56c55b3ae13bfac368bb84ec632193) and update to version 3.6.0 or later of the phpservermon/phpservermon package. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for phpservermon/phpservermon →
FAQ
This vulnerability can potentially allow unauthorized access to user accounts and sensitive information.
Yes, this vulnerability has been disclosed to the public and the exploit may be used by attackers.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity.
The recommended patch for this vulnerability is 3daa804d5f56c55b3ae13bfac368bb84ec632193.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for phpservermon/phpservermon.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
