What is the CVSS score of CVE-2019-11808?

CVE-2019-11808 has a CVSS 3.0 base score of 3.7 (Low). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 1.3%.

Is there a patch available for CVE-2019-11808?

Yes, a patch is available for CVE-2019-11808. Update the affected software to the latest version immediately.

Ratpack CVE-2019-11808

LOW

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2019-05-07 cve@mitre.org

Information Disclosure Ratpack

3.7

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

May 07, 2019 - 07:29 nvd

LOW 3.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on io.ratpack:ratpack-groovy (1 direct, 0 indirect)
2 maven packages depend on io.ratpack:ratpack-session (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.6.1 and other introduced versions.

DescriptionNVD

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.

AnalysisAI

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-338. Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs. Affected products include: Ratpack Project Ratpack. Version information: before 1.6.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.