CVE-2023-4472 - Vulnerability Details - OpenCVE

Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00116.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Objectplanet	Opinio

Configuration 1 [-]

cpe:2.3:a:objectplanet:opinio:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-54327	Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md
https://www.objectplanet.com/opinio/changelog.html

History

Wed, 11 Jun 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Mandiant

Published: 2024-02-01T22:11:21.361Z

Updated: 2025-06-11T16:45:41.501Z

Reserved: 2023-08-21T19:42:17.822Z

Link: CVE-2023-4472

Vulnrichment

Updated: 2024-08-02T07:31:05.503Z

NVD

Status : Modified

Published: 2024-02-01T22:15:55.220

Modified: 2025-06-11T17:15:35.480

Link: CVE-2023-4472

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4472", "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "state": "PUBLISHED", "assignerShortName": "Mandiant", "dateReserved": "2023-08-21T19:42:17.822Z", "datePublished": "2024-02-01T22:11:21.361Z", "dateUpdated": "2025-06-11T16:45:41.501Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["All", "Cloud", "Browser"], "product": "Opinio", "vendor": "Objectplanet", "versions": [{"status": "affected", "version": "7.22"}, {"status": "unaffected", "version": "7.23"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Amine Ismail, Mandiant"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Amine Ismail, Mandiant"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application."}], "value": "Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application."}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59 Session Credential Falsification through Prediction"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-335", "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "shortName": "Mandiant", "dateUpdated": "2024-02-01T22:11:21.361Z"}, "references": [{"url": "https://www.objectplanet.com/opinio/changelog.html"}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2023-08-21T17:00:00.000Z", "value": "Issue reported to Objectplanet and CVE number assigned."}, {"lang": "en", "time": "2023-08-22T17:00:00.000Z", "value": "Issue confirmed by Objectplanet and announced that a patch will be released in the next version."}, {"lang": "en", "time": "2023-08-31T17:00:00.000Z", "value": "Objectplanet released version 7.23. Mandiant delayed vulnerability disclosure to allow Opinio customers time to patch."}], "title": "Cryptographically weak PRNG in Opinio 7.22", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-02-21T19:37:11.901532Z", "id": "CVE-2023-4472", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T16:45:41.501Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:31:05.503Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.objectplanet.com/opinio/changelog.html", "tags": ["x_transferred"]}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.objectplanet.com/opinio/changelog.html", "tags": ["x_transferred"]}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:31:05.503Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-4472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-21T19:37:11.901532Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:12.242Z"}}], "cna": {"title": "Cryptographically weak PRNG in Opinio 7.22", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Amine Ismail, Mandiant"}, {"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Amine Ismail, Mandiant"}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59 Session Credential Falsification through Prediction"}]}], "affected": [{"vendor": "Objectplanet", "product": "Opinio", "versions": [{"status": "affected", "version": "7.22"}, {"status": "unaffected", "version": "7.23"}], "platforms": ["All", "Cloud", "Browser"], "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2023-08-21T17:00:00.000Z", "value": "Issue reported to Objectplanet and CVE number assigned."}, {"lang": "en", "time": "2023-08-22T17:00:00.000Z", "value": "Issue confirmed by Objectplanet and announced that a patch will be released in the next version."}, {"lang": "en", "time": "2023-08-31T17:00:00.000Z", "value": "Objectplanet released version 7.23. Mandiant delayed vulnerability disclosure to allow Opinio customers time to patch."}], "references": [{"url": "https://www.objectplanet.com/opinio/changelog.html"}, {"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.", "supportingMedia": [{"type": "text/html", "value": "Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-335", "description": "CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)"}]}], "providerMetadata": {"orgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "shortName": "Mandiant", "dateUpdated": "2024-02-01T22:11:21.361Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4472", "state": "PUBLISHED", "dateUpdated": "2025-06-11T16:45:41.501Z", "dateReserved": "2023-08-21T19:42:17.822Z", "assignerOrgId": "027e81ed-0dd4-4685-ab4d-884aec5bb484", "datePublished": "2024-02-01T22:11:21.361Z", "assignerShortName": "Mandiant"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:objectplanet:opinio:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A09C2A9-4E46-4B49-AC57-DEFD7E693093", "versionEndExcluding": "7.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application."}, {"lang": "es", "value": "Objectplanet Opinio versi\u00f3n 7.22 y anteriores utiliza un generador de n\u00fameros pseudoaleatorios (PRNG) criptogr\u00e1ficamente d\u00e9bil acoplado a una semilla predecible, lo que podr\u00eda conducir a una apropiaci\u00f3n no autenticada de la cuenta de cualquier usuario de la aplicaci\u00f3n."}], "id": "CVE-2023-4472", "lastModified": "2025-06-11T17:15:35.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-02-01T22:15:55.220", "references": [{"source": "mandiant-cve@google.com", "tags": ["Third Party Advisory"], "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md"}, {"source": "mandiant-cve@google.com", "tags": ["Release Notes"], "url": "https://www.objectplanet.com/opinio/changelog.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://www.objectplanet.com/opinio/changelog.html"}], "sourceIdentifier": "mandiant-cve@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-335"}], "source": "mandiant-cve@google.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-335"}], "source": "nvd@nist.gov", "type": "Primary"}]}