AES256 Text Encryption Vulnerability in Sakai Collaboration Environment

CVE-2025-62710

What is CVE-2025-62710?

The Sakai Collaboration and Learning Environment is susceptible to a vulnerability where the EncryptionUtilityServiceImpl improperly initializes the AES256TextEncryptor's serverSecretKey. This flaw stems from the utilization of java.util.Random, a non-cryptographic pseudorandom number generator (PRNG), which can produce predictable outputs under certain conditions. As a result, an attacker capable of accessing encrypted data (such as exported or stored strings) may exploit this weakness to reconstruct the serverSecretKey by approximating the PRNG seed, allowing them to decrypt sensitive information. Updates in versions 23.5 and 25.0 address this issue.

References