CVE-2021-4241: PHPServerMon Insufficient Entropy Vulnerability
Summary
CVE-2021-4241: PHPServerMon PRNG has Insufficient Entropy. Affects phpservermon/phpservermon versions < 3.6.0. Fixed in 3.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHPServerMon is an open-source monitoring tool written in PHP. It is designed to monitor the status and performance of servers, services, and network devices. PHPServerMon allows users to track the availability and response time of various services and provides a web interface for easy monitoring. However, a vulnerability has been discovered in PHPServerMon that could compromise the security of the application.
Vulnerability Detail
The vulnerability, identified as CVE-2021-4241, resides in the setUserLoggedIn function of the User.php file in PHPServerMon. This function uses a predictable algorithm in the random number generator, resulting in insufficient entropy. An attacker could exploit this vulnerability to predict the generated random numbers, potentially leading to the compromise of sensitive information or unauthorized access to the application. The vulnerability has been classified as moderate severity with a CVSS score of 5.3.
How To Fix
Minimum fixed version
3.6.0
This is the first release that contains the fix.
composer require phpservermon/phpservermon:3.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The PHPServerMon Insufficient Entropy vulnerability (CVE-2021-4241) poses a risk to the security of the application. It is crucial to apply the provided patch or update to PHPServerMon version 3.6.0 or later to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpservermon/phpservermon →
FAQ
PHPServerMon is an open-source monitoring tool used to track the availability and performance of servers, services, and network devices.
The vulnerability allows an attacker to predict random numbers generated by PHPServerMon, potentially leading to unauthorized access or compromise of sensitive information.
To fix this vulnerability, update PHPServerMon to version 3.6.0 or later, which includes the patch for this issue.
No specific workaround has been provided. It is recommended to apply the patch as soon as possible.
The vulnerability has been classified as moderate severity with a CVSS score of 5.3.
Related vulnerabilities
Recent vulnerabilities recorded for phpservermon/phpservermon.
