Description
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confirm opt-ins, accept or decline event invitations on behalf of other contacts, and access event details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EspoCRM | EspoCRM | ≤ 10.0.8 | — |
References
- Reporter write-up technical-description
- Patch Commit (unreleased at time of assignment) patch
- Util::generateMoreEntropyId() at 10.0.8 technical-description
- UniqueId::getNew() applies the weak generator technical-description
- https://github.com/espocrm/espocrm product
- VulnCheck Advisory: EspoCRM through 10.0.8 Weak Token Generation via rand() third-party-advisory