Raw vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-7659 is a medium-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Projectsend Projectsend. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Forge Web Credentials (T1606); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-12 (Cryptographic Key Establishment and Management) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48544
Vulnerability Data
A vulnerability, which was classified as problematic, was found in projectsend up to r1605. Affected is the function generate_random_string of the file includes/functions.php of the component Password Reset Token Handler. The manipulation leads to insufficiently random values. It is possible…
more
to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version r1720 is able to address this issue. The name of the patch is aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-12 requires proper cryptographic key establishment and management, which structurally mandates use of sufficient randomness for key generation.
SC-13 requires selection and implementation of approved cryptographic algorithms and methods, which inherently depend on and enforce sufficiently random values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce use of cryptographically strong RNGs and catch insufficient randomness during design, coding, and testing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic controls require use of approved, sufficiently random values for keys and nonces.
Security testing can detect weak randomness but does not prescribe the control itself.
Secure SDLC processes include verification steps that can catch insufficient randomness but do not directly specify RNG requirements.
Secure coding standards explicitly prohibit use of weak or predictable random number generators.
Secure authentication mechanisms depend on unpredictable values (nonces, salts, session tokens) to resist guessing.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (3 rules)
- V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-330
- V-248599 OL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
- V-248600 OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
Oracle Linux 9 (1 rule)
- V-271511 OL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 8 (3 rules)
- V-244527 RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
- V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-330
- V-230285 RHEL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 9 (1 rule)
- V-257782 RHEL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330