Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23472

CVE-2022-23472: Passeo uses insecure random number generator

5.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23472
GHSA ID
GHSA-mhhf-vgwh-fw9h
EPSS Score
0.29385%
CWE
CWE-338
Published
12/6/2022
Updated
10/9/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
Passeopip< 1.0.51.0.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from using Python's insecure random module for password generation. The commit diff shows the vulnerable version used random.sample() in the generate function, which was replaced with secrets.choice() in the patched version. This matches the CWE-338 description of using weak PRNGs. No other functions in the diff show direct use of random for security-sensitive operations.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *v*ryon* **low v*.*.* is imp**t** *y t*is *l*w, o* *on*i**nti*lity **in* *t risk *u* to t** p*sswor*(s) **in* **sily **l* to ** *u*ss** wit* P*ss*o's us* o* t** ``r*n*om`` li*r*ry. It is r**omm*n*** to ***n** *ny p*sswor*s m*** wit* P*ss*o

Reasoning

T** vuln*r**ility st*ms *rom usin* Pyt*on's ins**ur* r*n*om mo*ul* *or p*sswor* **n*r*tion. T** *ommit *i** s*ows t** vuln*r**l* v*rsion us** `r*n*om.s*mpl*()` in t** `**n*r*t*` *un*tion, w*i** w*s r*pl**** wit* `s**r*ts.**oi**()` in t** p*t**** v*rs