How severe is CVE-2023-4472?

CVE-2023-4472 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-4472 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-4472?

CVE-2023-4472 affects Objectplanet Opinio. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-4472?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2023-4472 have an EU (EUVD) identifier?

Yes. CVE-2023-4472 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-54327.

When was CVE-2023-4472 published?

CVE-2023-4472 was published on 2024-02-01 and last updated on 2026-06-17.

CVE-2023-4472

CVE-2023-4472 is a critical-severity vulnerability in Objectplanet Opinio with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-335.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 1% (45th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2023-54327
Weakness: CWE-335
Affected product: Objectplanet Opinio
Published: 2024-02-01
Last modified: 2026-06-17

Description

Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.

Frequently asked questions

What is CVE-2023-4472?: Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application.
How severe is CVE-2023-4472?: CVE-2023-4472 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-4472 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-4472?: CVE-2023-4472 affects Objectplanet Opinio. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-4472?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2023-4472 have an EU (EUVD) identifier?: Yes. CVE-2023-4472 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-54327.
When was CVE-2023-4472 published?: CVE-2023-4472 was published on 2024-02-01 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:objectplanet:opinio:*:*:*:*:*:*:*:*

More vulnerabilities in Objectplanet Opinio

CVE-2025-13872 — Critical (CVSS 9.1): Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on…
CVE-2025-13871 — High (CVSS 8.8): Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562…
CVE-2020-26806 — High (CVSS 8.8): admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files, resulting in…
CVE-2020-26565 — High (CVSS 7.5): ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter.…
CVE-2020-26564 — Medium (CVSS 6.5): ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create…
CVE-2020-26563 — Medium (CVSS 6.1): ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query…

All CVEs affecting Objectplanet Opinio →

Other CWE-335 vulnerabilities

CVE-2024-36048 — Critical (CVSS 9.8): QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6,…
CVE-2012-1577 — Critical (CVSS 9.8): lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
CVE-2019-11495 — Critical (CVSS 9.8): In Couchbase Server 5.1.1, the cookie used for intra-node communication was not generated securely. Couchbase Server…
CVE-2019-10908 — Critical (CVSS 9.8): In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which…
CVE-2017-11519 — Critical (CVSS 9.8): passwd_recovery.lua on the TP-Link Archer C9(UN)_V2_160517 allows an attacker to reset the admin password by leveraging…
CVE-2024-27632 — High (CVSS 8.8): An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the…

Browse all CWE-335 vulnerabilities →