Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery
概要
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filena...
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads.
出典: CVE.org (CVE Program・cvelistV5) NVD