Vulnerability in Yiisoft Yiisoft/yii2

CVE-2021-3689

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator

EPSS: 0.004 (64.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Yiisoft Yiisoft/yii2 — versions unspecified

Weakness classification (CWE)

CWE-1241

Public proof-of-concept exploits

References

huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f (x_refsource_CONFIRM)
github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46 (x_refsource_MISC)

Frequently asked questions

What is CVE-2021-3689?: CVE-2021-3689 is a high-severity vulnerability in Yiisoft Yiisoft/yii2, classified under CWE-1241. CVSS score: 8.1/10. Published 2021-08-10.
How severe is CVE-2021-3689?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2021-3689 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.