Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
In Zend Framework, `Zend_Captcha_Word` (v1) and `Zend\Captcha\Word` (v2) generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal `array_rand()` function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | zendframework/zend-captcha (Packagist) | 2.0.0 to before 2.4.9 | 2.4.9 | Patch available | GHSA-mg4x-prh7-g4mx |
| — | zendframework/zend-captcha (Packagist) | 2.5.0 to before 2.5.2 | 2.5.2 | Patch available | GHSA-mg4x-prh7-g4mx |
- zendframework/zend-captcha (Packagist) Vendor— Affected 2.0.0 to before 2.4.9 Fixed in 2.4.9 Patch available GHSA-mg4x-prh7-g4mx
- zendframework/zend-captcha (Packagist) Vendor— Affected 2.5.0 to before 2.5.2 Fixed in 2.5.2 Patch available GHSA-mg4x-prh7-g4mx
Remediation
- Fix · GHSA-mg4x-prh7-g4mx zendframework/zend-captcha (Packagist) Fixed in 2.4.9 Advisory →
- Fix · GHSA-mg4x-prh7-g4mx zendframework/zend-captcha (Packagist) Fixed in 2.5.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-mg4x-prh7-g4mx
References
Other 5
- https://github.com/zendframework/zend-captcha/commit/43c276df6e94e498bf530538aea53876a24fc47c
- https://github.com/zendframework/zend-captcha/commit/5561ef813bb4ad814e835343289dc5077d2eb262
- https://framework.zend.com/security/advisory/ZF2015-09
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-captcha/ZF2015-09.yaml
- https://github.com/zendframework/zend-captcha
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences