CVE-2023-46740 (GCVE-0-2023-46740)

Vulnerability from cvelistv5 – Published: 2024-01-03 16:20 – Updated: 2025-06-17 20:29
VLAI?
Title
Insecure random string generator used for sensitive data
Summary
CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the “accessKey”. To create the "accesKey", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.
Severity ?
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE
  • CWE-330 - Use of Insufficiently Random Values
Assigner
References
Impacted products
Vendor Product Version
cubefs cubefs Affected: < 3.3.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:53:20.897Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm"
          },
          {
            "name": "https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-11T15:51:34.830602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T20:29:07.424Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cubefs",
          "vendor": "cubefs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the \u201caccessKey\u201d. To create the \"accesKey\", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-330",
              "description": "CWE-330: Use of Insufficiently Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-03T16:20:18.619Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm"
        },
        {
          "name": "https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba"
        }
      ],
      "source": {
        "advisory": "GHSA-4248-p65p-hcrm",
        "discovery": "UNKNOWN"
      },
      "title": "Insecure random string generator used for sensitive data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-46740",
    "datePublished": "2024-01-03T16:20:18.619Z",
    "dateReserved": "2023-10-25T14:30:33.753Z",
    "dateUpdated": "2025-06-17T20:29:07.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-46740",
      "date": "2026-04-30",
      "epss": "0.00072",
      "percentile": "0.21721"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:linuxfoundation:cubefs:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"3.3.1\", \"matchCriteriaId\": \"6E8D59D8-6863-4398-9D77-2442BAF81108\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the \\u201caccessKey\\u201d. To create the \\\"accesKey\\\", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.\"}, {\"lang\": \"es\", \"value\": \"CubeFS es un sistema de almacenamiento de archivos nativo de la nube de c\\u00f3digo abierto. Antes de la versi\\u00f3n 3.3.1, CubeFS usaba un generador de cadenas aleatorias inseguras para generar claves confidenciales espec\\u00edficas del usuario utilizadas para autenticar a los usuarios en una implementaci\\u00f3n de CubeFS. Esto podr\\u00eda permitir a un atacante predecir y/o adivinar la cadena generada y hacerse pasar por un usuario, obteniendo as\\u00ed mayores privilegios. Cuando CubeFS crea nuevos usuarios, crea una informaci\\u00f3n confidencial para el usuario llamada \\\"clave de acceso\\\". Para crear la \\\"clave de acceso\\\", CubeFS utiliza un generador de cadenas inseguro que hace que sea f\\u00e1cil de adivinar y, por lo tanto, suplantar al usuario creado. Un atacante podr\\u00eda aprovechar el predecible generador de cadenas aleatorias y adivinar la clave de acceso de un usuario y hacerse pasar por el usuario para obtener mayores privilegios. El problema se solucion\\u00f3 en v3.3.1. No hay otra mitigaci\\u00f3n que actualizar.\"}]",
      "id": "CVE-2023-46740",
      "lastModified": "2024-11-21T08:29:12.190",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 3.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-01-03T17:15:10.590",
      "references": "[{\"url\": \"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-330\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-46740\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-01-03T17:15:10.590\",\"lastModified\":\"2024-11-21T08:29:12.190\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the \u201caccessKey\u201d. To create the \\\"accesKey\\\", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.\"},{\"lang\":\"es\",\"value\":\"CubeFS es un sistema de almacenamiento de archivos nativo de la nube de c\u00f3digo abierto. Antes de la versi\u00f3n 3.3.1, CubeFS usaba un generador de cadenas aleatorias inseguras para generar claves confidenciales espec\u00edficas del usuario utilizadas para autenticar a los usuarios en una implementaci\u00f3n de CubeFS. Esto podr\u00eda permitir a un atacante predecir y/o adivinar la cadena generada y hacerse pasar por un usuario, obteniendo as\u00ed mayores privilegios. Cuando CubeFS crea nuevos usuarios, crea una informaci\u00f3n confidencial para el usuario llamada \\\"clave de acceso\\\". Para crear la \\\"clave de acceso\\\", CubeFS utiliza un generador de cadenas inseguro que hace que sea f\u00e1cil de adivinar y, por lo tanto, suplantar al usuario creado. Un atacante podr\u00eda aprovechar el predecible generador de cadenas aleatorias y adivinar la clave de acceso de un usuario y hacerse pasar por el usuario para obtener mayores privilegios. El problema se solucion\u00f3 en v3.3.1. No hay otra mitigaci\u00f3n que actualizar.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.2,\"impactScore\":3.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-330\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:linuxfoundation:cubefs:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3.1\",\"matchCriteriaId\":\"6E8D59D8-6863-4398-9D77-2442BAF81108\"}]}]}],\"references\":[{\"url\":\"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\", \"name\": \"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\", \"name\": \"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T20:53:20.897Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-46740\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-01-11T15:51:34.830602Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-17T20:24:07.428Z\"}}], \"cna\": {\"title\": \"Insecure random string generator used for sensitive data\", \"source\": {\"advisory\": \"GHSA-4248-p65p-hcrm\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"cubefs\", \"product\": \"cubefs\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.3.1\"}]}], \"references\": [{\"url\": \"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\", \"name\": \"https://github.com/cubefs/cubefs/security/advisories/GHSA-4248-p65p-hcrm\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\", \"name\": \"https://github.com/cubefs/cubefs/commit/8555c6402794cabdf2cc025c8bea1576122c07ba\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"CubeFS is an open-source cloud-native file storage system. Prior to version 3.3.1, CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates new users, it creates a piece of sensitive information for the user called the \\u201caccessKey\\u201d. To create the \\\"accesKey\\\", CubeFS uses an insecure string generator which makes it easy to guess and thereby impersonate the created user. An attacker could leverage the predictable random string generator and guess a users access key and impersonate the user to obtain higher privileges. The issue has been fixed in v3.3.1. There is no other mitigation than to upgrade.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-330\", \"description\": \"CWE-330: Use of Insufficiently Random Values\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-01-03T16:20:18.619Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-46740\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-17T20:29:07.424Z\", \"dateReserved\": \"2023-10-25T14:30:33.753Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-01-03T16:20:18.619Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.