description: ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.
problem types: Use of Insufficiently Random Values (CWE-330)
affected:
{
product: ExpressionEngine
vendor: EllisLab
versions:
status: affected, version: Versions before 2.11.8 and 3.5.5
}