CWE-1241

Use of Predictable Algorithm in Random Number Generator

The device uses an algorithm that is predictable and generates a pseudo-random number.

CVE-2021-3689 (GCVE-0-2021-3689)

Vulnerability from cvelistv5 – Published: 2021-08-10 10:21 – Updated: 2024-08-03 17:01
VLAI?
Summary
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Severity ?
8.1 (High)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-1241 - Use of Predictable Algorithm in Random Number Generator
Assigner
References
Impacted products
Vendor Product Version
yiisoft yiisoft/yii2 Affected: unspecified , ≤ 2.0.42.1 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:07.696Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yiisoft/yii2",
          "vendor": "yiisoft",
          "versions": [
            {
              "lessThanOrEqual": "2.0.42.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1241",
              "description": "CWE-1241 Use of Predictable Algorithm in Random Number Generator",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-10T10:21:30",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46"
        }
      ],
      "source": {
        "advisory": "50aad1d4-eb00-4573-b8a4-dbe38e2c229f",
        "discovery": "EXTERNAL"
      },
      "title": "Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3689",
          "STATE": "PUBLIC",
          "TITLE": "Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yiisoft/yii2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.0.42.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yiisoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1241 Use of Predictable Algorithm in Random Number Generator"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/50aad1d4-eb00-4573-b8a4-dbe38e2c229f"
            },
            {
              "name": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46",
              "refsource": "MISC",
              "url": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46"
            }
          ]
        },
        "source": {
          "advisory": "50aad1d4-eb00-4573-b8a4-dbe38e2c229f",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3689",
    "datePublished": "2021-08-10T10:21:30",
    "dateReserved": "2021-08-07T00:00:00",
    "dateUpdated": "2024-08-03T17:01:07.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3692 (GCVE-0-2021-3692)

Vulnerability from cvelistv5 – Published: 2021-08-10 15:36 – Updated: 2024-08-03 17:01
VLAI?
Summary
yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Severity ?
8.1 (High)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-1241 - Use of Predictable Algorithm in Random Number Generator
Assigner
References
Impacted products
Vendor Product Version
yiisoft yiisoft/yii2 Affected: unspecified , ≤ 2.0.42.1 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.488Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/55517f19-5c28-4db2-8b00-f78f841e8aba"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yiisoft/yii2",
          "vendor": "yiisoft",
          "versions": [
            {
              "lessThanOrEqual": "2.0.42.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator"
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1241",
              "description": "CWE-1241 Use of Predictable Algorithm in Random Number Generator",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-10T15:36:00",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/55517f19-5c28-4db2-8b00-f78f841e8aba"
        }
      ],
      "source": {
        "advisory": "55517f19-5c28-4db2-8b00-f78f841e8aba",
        "discovery": "EXTERNAL"
      },
      "title": "Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2021-3692",
          "STATE": "PUBLIC",
          "TITLE": "Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "yiisoft/yii2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "2.0.42.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "yiisoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator"
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-1241 Use of Predictable Algorithm in Random Number Generator"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46",
              "refsource": "MISC",
              "url": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46"
            },
            {
              "name": "https://huntr.dev/bounties/55517f19-5c28-4db2-8b00-f78f841e8aba",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/55517f19-5c28-4db2-8b00-f78f841e8aba"
            }
          ]
        },
        "source": {
          "advisory": "55517f19-5c28-4db2-8b00-f78f841e8aba",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2021-3692",
    "datePublished": "2021-08-10T15:36:00",
    "dateReserved": "2021-08-09T00:00:00",
    "dateUpdated": "2024-08-03T17:01:08.488Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-4695 (GCVE-0-2023-4695)

Vulnerability from cvelistv5 – Published: 2023-09-01 00:00 – Updated: 2024-09-30 20:23
VLAI?
Summary
Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
Severity ?
9.6 (Critical)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE
  • CWE-1241 - Use of Predictable Algorithm in Random Number Generator
Assigner
References
Impacted products
Vendor Product Version
pkp pkp/pkp-lib Affected: unspecified , < 3.3.0-16 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:37:59.514Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/887c7fc7-70c8-482d-b570-350533af4702"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/pkp/pkp-lib/commit/e5e7e543887fe77708aa31e07b18fe85f9b5a3b5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-4695",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T20:23:34.186812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T20:23:51.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pkp/pkp-lib",
          "vendor": "pkp",
          "versions": [
            {
              "lessThan": "3.3.0-16",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1241",
              "description": "CWE-1241 Use of Predictable Algorithm in Random Number Generator",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-01T00:00:19.729Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "url": "https://huntr.dev/bounties/887c7fc7-70c8-482d-b570-350533af4702"
        },
        {
          "url": "https://github.com/pkp/pkp-lib/commit/e5e7e543887fe77708aa31e07b18fe85f9b5a3b5"
        }
      ],
      "source": {
        "advisory": "887c7fc7-70c8-482d-b570-350533af4702",
        "discovery": "EXTERNAL"
      },
      "title": "Use of Predictable Algorithm in Random Number Generator in pkp/pkp-lib"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2023-4695",
    "datePublished": "2023-09-01T00:00:19.729Z",
    "dateReserved": "2023-09-01T00:00:07.257Z",
    "dateUpdated": "2024-09-30T20:23:51.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}
Mitigation

Phase: Architecture and Design

Description:

  • A true random number generator should be specified for cryptographic algorithms.
Mitigation

Phase: Implementation

Description:

  • A true random number generator should be implemented for cryptographic algorithms.
CAPEC-97: Cryptanalysis

Cryptanalysis is a process of finding weaknesses in cryptographic algorithms and using these weaknesses to decipher the ciphertext without knowing the secret key (instance deduction). Sometimes the weakness is not in the cryptographic algorithm itself, but rather in how it is applied that makes cryptanalysis successful. An attacker may have other goals as well, such as: Total Break (finding the secret key), Global Deduction (finding a functionally equivalent algorithm for encryption and decryption that does not require knowledge of the secret key), Information Deduction (gaining some information about plaintexts or ciphertexts that was not previously known) and Distinguishing Algorithm (the attacker has the ability to distinguish the output of the encryption (ciphertext) from a random permutation of bits).

Back to CWE stats page