CVE-2022-31157: LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.13687%
CWE
Published
7/15/2022
Updated
7/24/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| packbackbooks/lti-1-3-php-library | composer | < 5.0 | 5.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stemmed from using uniqid() with microtime-based entropy for cryptographic nonce and state generation. The commit de19e8a replaced these with secureRandomString() using random_bytes(64) + SHA-256 hashing. The original implementations in LtiOidcLogin.php's doOidcLoginRedirect method lacked sufficient cryptographic complexity, as uniqid() is not designed for security-sensitive contexts. This matches CWE-330 (Insufficient Randomness) and the advisory's description of predictable values.