5.3

CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Crypto-js Project ≫ Crypto-js Version < 3.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.08% 0.606
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

CWE-331 Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

https://github.com/brix/crypto-js/compare/3.2.0...3.2.1
Release Notes
https://github.com/brix/crypto-js/issues/254
Vendor Advisory
Issue Tracking
https://github.com/brix/crypto-js/issues/256
Patch
Vendor Advisory
Issue Tracking
https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b
Patch
https://security.netapp.com/advisory/ntap-20230706-0003/
https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472
Third Party Advisory