Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2018-1000620
HistoryJul 09, 2018 - 8:29 p.m.

CVE-2018-1000620

2018-07-0920:29:00
CWE-331
mitre
web.nvd.nist.gov
64
cve-2018-1000620
eran hammer
cryptiles
cwe-331
insufficient entropy
randomdigits()
nvd

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

58.6%

JSON

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random… This attack appear to be exploitable via Depends upon the calling application… This vulnerability appears to have been fixed in 4.1.2.

Affected configurations

Nvd
Node
cryptiles_projectcryptilesRange<3.1.3
OR
cryptiles_projectcryptilesRange4.1.0–4.1.2
VendorProductVersionCPE
cryptiles_projectcryptiles*cpe:2.3:a:cryptiles_project:cryptiles:*:*:*:*:*:*:*:*

Related

nvd 1
nodejs 2
redhatcve 1
osv 2
prion 1
cvelist 1
github 1
veracode 1
ibm 2
nvd
nvd
CVE-2018-1000620
2018-07-09 20:29:00
nodejs
nodejs
Insufficient Entropy
2018-11-01 18:32:48
Insufficient Entropy
2020-01-23 18:13:40
redhatcve
redhatcve
CVE-2018-1000620
2018-07-25 05:20:13
osv
osv
Insufficient Entropy in cryptiles
2018-09-11 18:22:50
CVE-2018-1000620
2018-07-09 20:29:00
prion
prion
Design/Logic Flaw
2018-07-09 20:29:00
cvelist
cvelist
CVE-2018-1000620
2018-07-09 20:00:00
github
github
Insufficient Entropy in cryptiles
2018-09-11 18:22:50
veracode
veracode
Insecure Random Number Generation
2018-07-10 07:42:04
ibm
ibm
Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)
2022-04-27 22:51:43
Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to vulnerabilities in multiple Open Source Software (OSS) components
2024-02-05 18:40:45

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

58.6%

JSON
Related for CVE-2018-1000620
nvd1nodejs2redhatcve1osv2prion1cvelist1github1veracode1ibm2