{"cve":"CVE-2025-62710","nvd":{"published":"2025-10-22T23:15:34.567","modified":"2026-10-08T11:10:00.250","status":"Analyzed","description":"Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9},"cwes":["CWE-337"],"references":["https://github.com/sakaiproject/sakai/commit/bde070104b1de01f4a6458dca6d9e0880a0e3c04","https://github.com/sakaiproject/sakai/security/advisories/GHSA-gr7h-xw4f-wh86"],"products":["sakailms:sakai"],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-62710","score":0.002,"percentile":0.09687,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-gr7h-xw4f-wh86","url":"https://osv.dev/vulnerability/GHSA-gr7h-xw4f-wh86","summary":"Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl","modified":"2025-10-24T18:59:01.678693Z","packages":[{"ecosystem":"Maven","name":"org.sakaiproject.kernel:sakai-kernel-impl","purl":"pkg:maven/org.sakaiproject.kernel/sakai-kernel-impl","ranges":["<=23.3"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}