blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2008-4107

MEDIUM 5.1 CVSS 2.0
Published
September 18, 2008
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-189
CVSS vector
AV:N/AC:H/Au:N/C:P/I:P/A:P

Description

The (1) rand and (2) mt_rand functions in PHP 5.2.6 do not produce cryptographically strong random numbers, which allows attackers to leverage exposures in products that rely on these functions for security-relevant functionality, as demonstrated by the password-reset functionality in Joomla! 1.5.x and WordPress before 2.6.2, a different vulnerability than CVE-2008-2107, CVE-2008-2108, and CVE-2008-4102.

Affected products and versions

  • PHP — Up to and including 4.4.8
  • PHP — Up to and including 5.2.5
  • PHP versions 4.0.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3patch1, 4.0.4patch1, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc2, 4.0.7rc3, 4.0.7rc4, 4.0beta1, 4.0beta3, 4.0rc1, 4.0rc2, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 5.0.0beta1, 5.0.0beta2, 5.0.0beta4, 5.0.0rc1, 5.0.1, 5.0.4, 5.0.5, 5.1.0, 5.1.2, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4

References