🛡️ CVE-2021-27913 — core

🟢 CVSS 2.0 — Low ✅ No Known Exploit CWE-327 OSV
2.0
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Use of a Broken or Risky Cryptographic Algorithm

✍️ Description

The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control

🕵️‍♂️ Proof of Concept

Numerous examples and attack implementations can be found in this paper . If you're looking for a practical tool that can crack your mt_rand implementation's seed value, see this project and run the following commands in a console with php5 and OpenWall's tool installed:

root$ php -r 'mt_srand(13333337); echo mt_rand( ), "\n";'

After that, copy the output (1863134308) and execute the following commands:

root$ gcc php_mt_seed.c -o php_mt_seedroot$ ./php_mt_seed 1863134308

After waiting ~1 minute you should have a few possible seeds corresponding to their PHP versions, next to your installed PHP version you should see something akin to:

seed = 0x00cb7359 = 13333337 (PHP 7.1.0+)

Hey, that's your seed!

💥 Impact

An attacker could takeover accounts at random by enumerating and using access tokens.

📝 References

  • https://openwall.com/php_mt_seedhttps://crypto.di.uoa.gr/CRYPTO.SEC/Randomness_Attacks_files/paper.pdf
  • https://github.com/mautic/mautic/blob/5213e320b4ef4d0c51bb84c1d46a1071e8e4f7fc/app/bundles/PointBundle/Controller/TriggerController.php#L187
  • https://github.com/mautic/mautic/releases/tag/3.3.4
  • https://github.com/mautic/mautic/releases/tag/4.0.0

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. A user must be tricked into taking some action. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability low.

Weakness class

CVE-2021-27913 is classified as CWE-327: Use of a Broken or Risky Cryptographic Algorithm. An algorithm with known weaknesses is used, so the protection it appears to give does not hold.

Affected software

CVE-2021-27913 is recorded against 1 package.

  • mautic/core (from 4.0.0-alpha1 up to 4.0.0)

Timeline and source

Published on 1 September 2021 and last revised on 8 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
github.com (Package)

Details

Severity LOW
CVSS Score 2.0
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CWE CWE-327
Public Exploit ✅ No
Source OSV
Published 2021-09-01
Updated 2026-08-12
Modified 2026-07-08
Fix URL N/A

Affected Packages

Software From version Fixed in
mautic/core 4.0.0-alpha1 4.0.0

Similar Threats

Free Vulnerability Check

Is your site affected by CVE-2021-27913?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2021-27913 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.