The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack.
Metrics
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None
This CVE is not in the KEV list.
Key SSVC decision points have not yet been added.
Affected Vendors & Products
Vendors | Products |
---|---|
Cherokee-project |
|
Configuration 1 [-]
|
No data.
References
History
No history.

Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-06T22:53:17.228Z
Reserved: 2011-05-31T00:00:00Z
Link: CVE-2011-2190

No data.

Status : Modified
Published: 2011-10-07T02:51:40.847
Modified: 2024-11-21T01:27:46.907
Link: CVE-2011-2190

No data.