-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework1 | composer | >= 1.12.0, < 1.12.17 | 1.12.17 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the use of array_rand() in the CAPTCHA word generation logic. The advisory explicitly states that Zend_Captcha_Word (v1) used array_rand(), which is not cryptographically secure. The method _generateWord in Zend_Captcha_AbstractWord (the parent class) is responsible for generating the CAPTCHA word and was patched to use Zend_Crypt_Math::randInteger() instead. The file path and method name are consistent with Zend Framework 1.x structure and the vulnerability description.
Ongoing coverage of React2Shell