Threats tagged 'ghsa-6jc7-hvrq-rjqm'

Seahub versions up to 14.0.10 have a weak randomness vulnerability in the MultiShareLinksBatch.post() function. This flaw uses Python's non-cryptographic random.choices() to generate batch share link passwords. Authenticated users who can create share links may exploit this to recover the internal Mersenne Twister state and predict other users' share link passwords. The vulnerability has a low CVSS score of 3.1 and does not impact integrity or availability.