-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using a predictable random number generator (java.util.Random) for CSRF token generation. The commit diff explicitly shows the replacement of Random with SecureRandom in the TokenHelper class, confirming this was the weak point. While no specific method is named in the diff, the RANDOM field is directly responsible for token value generation, making it the root cause of the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | < 2.3.20 | 2.3.20 |