CVE-2023-36993
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
In TravianZ versions 8.3.4 and 8.3.3, there is a vulnerability related to the use of a cryptographically insecure random number generator in the password reset function. This allows an attacker to guess the password reset parameters and take over user accounts.
Risk Assessment
This vulnerability poses a risk of account takeover, which can lead to data loss and privacy breaches.
Recommendation
It is recommended to update to the latest version of TravianZ that removes the use of the insecure random number generator in the password reset function.
Original NVD description (English source)
The cryptographically insecure random number generator being used in TravianZ 8.3.4 and 8.3.3 in the password reset function allows an attacker to guess the password reset.parameters and to take over accounts.