UpHeron
All vulnerabilities

Servers and applications

CVE-2021-27913

Use of a Broken or Risky Cryptographic Algorithm

Severity
Low 3.5
Published
30 Aug 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.3.4
Also known as
GHSA-x7g2-wrrp-r6h3
Sources
NVD, Project advisories (GitHub)

Description

The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control This issue affects: Mautic Mautic versions prior to 3.3.4; versions prior to 4.0.0.

Affected software

SoftwareAffected versions
MauticServers and applications · cpe:a:acquia:mautic
  • Every version before 3.3.4
  • Version 4.0.0-alpha1
  • Version 4.0.0-beta
  • Version 4.0.0-rc
MauticServers and applications · github:mautic/mautic
  • Every version before 3.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-27913
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-27913
  • GitHub Advisory Database https://github.com/advisories/GHSA-x7g2-wrrp-r6h3
  • github.com https://github.com/mautic/mautic/security/advisories/GHSA-x7g2-wrrp-r6h3