Description
The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
Remediation
References
Related Vulnerabilities
Oracle Database Server CVE-2010-2412 Vulnerability (CVE-2010-2412)
TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4901)
Craft CMS Files or Directories Accessible to External Parties Vulnerability (CVE-2024-52292)
WordPress Plugin Post Grid Gutenberg Blocks and WordPress Blog-PostX Security Bypass (4.1.2)