CWE-340
Allowed-with-ReviewGeneration of Predictable Numbers or Identifiers
Abstraction: Class · Status: Incomplete
The product uses a scheme that generates numbers or identifiers that are more predictable than required.
84 vulnerabilities reference this CWE, most recent first.
GHSA-4277-M35Q-7C9W
Vulnerability from github – Published: 2024-11-14 06:30 – Updated: 2024-11-14 18:06The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3005.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"events": [
{
"introduced": "3006.0rc1"
},
{
"fixed": "3006.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-34049"
],
"database_specific": {
"cwe_ids": [
"CWE-340"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-14T18:06:53Z",
"nvd_published_at": "2024-11-14T05:15:28Z",
"severity": "MODERATE"
},
"details": "The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH.\u00a0Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.",
"id": "GHSA-4277-m35q-7c9w",
"modified": "2024-11-14T18:06:53Z",
"published": "2024-11-14T06:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34049"
},
{
"type": "WEB",
"url": "https://github.com/saltstack/salt/commit/286d55eb5a6e6bf9428405bdf5632b419bdf8444"
},
{
"type": "WEB",
"url": "https://github.com/saltstack/salt/commit/7a14112f2a16ce70e3c3e1862c92e37af5f2c7a4"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
},
{
"type": "WEB",
"url": "https://saltproject.io/security-announcements/2023-10-27-advisory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Salt preflight script could be attacker controlled"
}
GHSA-4GH8-X3VV-PHHG
Vulnerability from github – Published: 2021-05-18 18:30 – Updated: 2023-01-10 16:09Impact
The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency.
Patches
A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade.
The patch is commit https://github.com/sylabs/sif/commit/193962882122abf85ff5f5bcc86404933e71c07d
Workarounds
Users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:
go get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557
References
- https://github.com/satori/go.uuid/issues/73
For more information
If you have any questions or comments about this advisory: * Open an issue in github.com/sylabs/sif * Email us at security@sylabs.io
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/sylabs/sif"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-29499"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-340"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T17:01:30Z",
"nvd_published_at": "2021-05-07T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThe `siftool new` command and [func siftool.New()](https://pkg.go.dev/github.com/sylabs/sif/pkg/siftool#New) produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency.\n\n### Patches\n\nA patch is available in version \u003e= v1.2.3 of the module. Users are encouraged to upgrade.\n\nThe patch is commit https://github.com/sylabs/sif/commit/193962882122abf85ff5f5bcc86404933e71c07d\n\n### Workarounds\nUsers passing [CreateInfo struct](https://pkg.go.dev/github.com/sylabs/sif/pkg/sif#CreateInfo) should ensure the `ID` field is generated using a version of `github.com/satori/go.uuid` that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:\n\n```\ngo get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557\n```\n\n### References\n* https://github.com/satori/go.uuid/issues/73\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/sylabs/sif](https://github.com/sylabs/sif/issues/new)\n* Email us at [security@sylabs.io](mailto:security@sylabs.io)\n",
"id": "GHSA-4gh8-x3vv-phhg",
"modified": "2023-01-10T16:09:36Z",
"published": "2021-05-18T18:30:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sylabs/sif/security/advisories/GHSA-4gh8-x3vv-phhg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29499"
},
{
"type": "WEB",
"url": "https://github.com/satori/go.uuid/issues/73"
},
{
"type": "WEB",
"url": "https://github.com/sylabs/sif/commit/193962882122abf85ff5f5bcc86404933e71c07d"
},
{
"type": "PACKAGE",
"url": "https://github.com/sylabs/sif"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Predictable SIF UUID Identifiers in github.com/sylabs/sif"
}
GHSA-4M3M-829W-5Q37
Vulnerability from github – Published: 2026-09-22 18:33 – Updated: 2026-09-22 18:33Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.
{
"affected": [],
"aliases": [
"CVE-2026-95653"
],
"database_specific": {
"cwe_ids": [
"CWE-340"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-22T16:18:18Z",
"severity": "HIGH"
},
"details": "Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.",
"id": "GHSA-4m3m-829w-5q37",
"modified": "2026-09-22T18:33:30Z",
"published": "2026-09-22T18:33:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95653"
},
{
"type": "WEB",
"url": "https://github.com/concretecms-community-store/community_store/commit/a71138db250d5c207e49fe3f1287241f04e3f747"
},
{
"type": "WEB",
"url": "https://github.com/concretecms-community-store/community_store"
},
{
"type": "WEB",
"url": "https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L17"
},
{
"type": "WEB",
"url": "https://github.com/concretecms-community-store/community_store/blob/v2.7.7/src/CommunityStore/Utilities/Download.php#L45"
},
{
"type": "WEB",
"url": "https://github.com/concretecms-community-store/community_store/releases/tag/v2.7.8"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/concrete-cms-community-store-before-2.7.8-predictable-digital-download-token"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-546V-XQJF-QGCR
Vulnerability from github – Published: 2026-05-06 15:32 – Updated: 2026-06-30 03:36Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure.
Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation.
The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header).
The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.
{
"affected": [],
"aliases": [
"CVE-2026-5081"
],
"database_specific": {
"cwe_ids": [
"CWE-340",
"CWE-341"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-06T13:16:09Z",
"severity": "CRITICAL"
},
"details": "Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure.\n\nApache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation.\n\nThe server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header).\n\nThe purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes.",
"id": "GHSA-546v-xqjf-qgcr",
"modified": "2026-06-30T03:36:33Z",
"published": "2026-05-06T15:32:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5081"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-5081"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467174"
},
{
"type": "WEB",
"url": "https://httpd.apache.org/docs/current/mod/mod_unique_id.html"
},
{
"type": "WEB",
"url": "https://metacpan.org/pod/Apache::Session::Generate::Random"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5081.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/06/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6RGW-QFM8-JFVG
Vulnerability from github – Published: 2025-10-07 21:31 – Updated: 2025-10-07 21:31Generation of Predictable Numbers or Identifiers vulnerability in B&R Industrial Automation Automation Runtime.This issue affects Automation Runtime: from 6.0 before 6.4.
{
"affected": [],
"aliases": [
"CVE-2025-3449"
],
"database_specific": {
"cwe_ids": [
"CWE-340"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-07T19:15:36Z",
"severity": "LOW"
},
"details": "Generation of Predictable Numbers or Identifiers vulnerability in B\u0026R Industrial Automation Automation Runtime.This issue affects Automation Runtime: from 6.0 before 6.4.",
"id": "GHSA-6rgw-qfm8-jfvg",
"modified": "2025-10-07T21:31:05Z",
"published": "2025-10-07T21:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3449"
},
{
"type": "WEB",
"url": "https://www.br-automation.com/fileadmin/SA25P003-178b6a20.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8JRH-WQ6H-53C4
Vulnerability from github – Published: 2026-07-16 21:30 – Updated: 2026-07-16 21:30An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
{
"affected": [],
"aliases": [
"CVE-2026-47085"
],
"database_specific": {
"cwe_ids": [
"CWE-340"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-16T19:16:49Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim\u0027s account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)",
"id": "GHSA-8jrh-wq6h-53c4",
"modified": "2026-07-16T21:30:36Z",
"published": "2026-07-16T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47085"
},
{
"type": "WEB",
"url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html"
},
{
"type": "WEB",
"url": "https://www.cyrusimap.org/imap/download/release-notes/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-98HX-VMW6-46W7
Vulnerability from github – Published: 2025-01-30 21:31 – Updated: 2025-07-29 21:30Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances.
{
"affected": [],
"aliases": [
"CVE-2024-10603"
],
"database_specific": {
"cwe_ids": [
"CWE-340"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-30T20:15:32Z",
"severity": "MODERATE"
},
"details": "Weaknesses in the generation of TCP/UDP source ports and some other header values in Google\u0027s gVisor allowed them to be predicted by an external attacker in some circumstances.",
"id": "GHSA-98hx-vmw6-46w7",
"modified": "2025-07-29T21:30:33Z",
"published": "2025-01-30T21:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10603"
},
{
"type": "WEB",
"url": "https://github.com/google/gvisor/commit/5d2bf2546805afa09a6f6d9b23ec267823e32205"
},
{
"type": "WEB",
"url": "https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2"
},
{
"type": "WEB",
"url": "https://github.com/google/gvisor/commit/cbdb2c61b1f753834cedf2ebe68cbc335dadca52"
},
{
"type": "WEB",
"url": "https://www.ndss-symposium.org/wp-content/uploads/2025-122-paper.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-CXVQ-C3R3-8GWQ
Vulnerability from github – Published: 2025-09-12 06:30 – Updated: 2025-11-18 21:32curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection.
A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy.
{
"affected": [],
"aliases": [
"CVE-2025-10148"
],
"database_specific": {
"cwe_ids": [
"CWE-340"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-12T06:15:40Z",
"severity": "MODERATE"
},
"details": "curl\u0027s websocket code did not update the 32 bit mask pattern for each new\n outgoing frame as the specification says. Instead it used a fixed mask that\npersisted and was used throughout the entire connection.\n\nA predictable mask pattern allows for a malicious server to induce traffic\nbetween the two communicating parties that could be interpreted by an involved\nproxy (configured or transparent) as genuine, real, HTTP traffic with content\nand thereby poison its cache. That cached poisoned content could then be\nserved to all users of that proxy.",
"id": "GHSA-cxvq-c3r3-8gwq",
"modified": "2025-11-18T21:32:29Z",
"published": "2025-09-12T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10148"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3330839"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-10148.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-10148.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/09/10/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/09/10/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/09/10/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GRQM-889W-4725
Vulnerability from github – Published: 2026-08-20 15:34 – Updated: 2026-08-20 15:34ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation tokens. This allows an attacker to activate an unconfirmed account without access to the victim's email inbox. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.
{
"affected": [],
"aliases": [
"CVE-2026-64964"
],
"database_specific": {
"cwe_ids": [
"CWE-340"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-20T14:17:44Z",
"severity": "MODERATE"
},
"details": "ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these values can guess valid account activation tokens. This allows an attacker to activate an unconfirmed account without access to the victim\u0027s email inbox.\nProduct is no longer actively supported and the vulnerabilities have not been fixed. Only version 2.2.4 was tested and confirmed as vulnerable, other versions were not tested but might also be vulnerable.",
"id": "GHSA-grqm-889w-4725",
"modified": "2026-08-20T15:34:17Z",
"published": "2026-08-20T15:34:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64964"
},
{
"type": "WEB",
"url": "https://atutor.github.io"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2026/08/CVE-2026-64960"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J2PC-4J53-Q3WW
Vulnerability from github – Published: 2025-01-07 21:30 – Updated: 2025-11-03 18:31When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-create the directory and thus prevent pgAgent from executing jobs, disrupting scheduled tasks.
{
"affected": [],
"aliases": [
"CVE-2025-0218"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-340"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T20:15:30Z",
"severity": "MODERATE"
},
"details": "When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-create the directory and thus prevent pgAgent from executing jobs, disrupting scheduled tasks.",
"id": "GHSA-j2pc-4j53-q3ww",
"modified": "2025-11-03T18:31:15Z",
"published": "2025-01-07T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0218"
},
{
"type": "WEB",
"url": "https://github.com/pgadmin-org/pgagent/commit/1ecd193a2be3a3dc9e98f369495e1a792e6d508c"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00018.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.