TI-2023-04128 Aliases CVE-2023-4472 GHSA-x62r-6wv3-49pm

Cryptographically weak PRNG in Opinio 7.22

MEDIUM 43CWE-335Published 2024-02-01 · Updated 2025-06-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00742 54th percentileScored 2026-11-07

Fix Fixed Opinio (Objectplanet): 7.23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ObjectPlanet	Opinio	7.22 and later	7.23	Patch available	CNA

Opinio VendorObjectPlanet Affected 7.22 and later Fixed in 7.23 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:objectplanet:opinio::::::::	before 7.23	Vulnerable	ObjectPlanet

cpe:2.3:a:objectplanet:opinio:*:*:*:*:*:*:*:* Versions before 7.23 Vulnerable ·ObjectPlanet

Remediation

Fix · CNA Opinio (Objectplanet) Fixed in 7.23

Timeline

2026-10-02 Threatist record created from CVE-2023-4472
2026-10-03 Alias added: GHSA-x62r-6wv3-49pm

References

Advisory 1

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2024/MNDT-2024-0002.md

Other 1

https://www.objectplanet.com/opinio/changelog.html

TI-2020-16273 admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of… CVSS 3.1HIGH 8.8
TI-2020-16198 ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the… CVSS 3.1HIGH 7.5
TI-2020-16197 ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to… CVSS 3.1MEDIUM 6.5
TI-2020-16196 ObjectPlanet Opinio before 7.14 allows reflected XSS via the… CVSS 3.1MEDIUM 6.1
TI-2017-07902 In ObjectPlanet Opinio before 7.6.4, there is XSS. CVSS 3.0MEDIUM 6.1
TI-2025-12677 The feature to import a survey is prone to stored Cross-Site Script attacks CVSS 4.0MEDIUM 4.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences