Weaknesses of type CWE-331

87 results

Entropia insuficiente em geração de valores aleatórios

A aplicação gera números aleatórios, tokens, chaves ou IDs usando fontes de entropia fraca ou previsível, permitindo que um atacante adivinhe ou reproduza esses valores. Isso compromete mecanismos que dependem de aleatoriedade criptográfica, como sessões, recuperação de conta e tokens de autenticação.

Example

Um sistema gera tokens de reset de senha usando Math.random() em JavaScript ou com seed baseado em timestamp previsível, permitindo que um atacante calcule o token válido antes da janela de expiração e resete a senha de qualquer usuário.

How to mitigate

Use geradores criptograficamente seguros nativos da plataforma (como `crypto.getRandomValues()` no navegador, `secrets` em Python ou `SecureRandom` em Java). Nunca use Math.random(), rand() ou srand(). Valide e revogue tokens após uso único quando possível.

CVE-2017-13992—An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently randoEPSS 3.5%CVE-2022-43755HIGHRancher: Non-random authentication tokenEPSS 1.7%CVE-2025-6931MEDIUMD-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropyEPSS 1.6%CVE-2021-36294CRITICALDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker mayEPSS 1.6%CVE-2020-1773HIGHSession / Password / Password token leakEPSS 1.5%CVE-2022-37401—Apache OpenOffice Weak Master KeysEPSS 1.5%CVE-2012-4687—Post Oak Bluetooth Traffic Systems Insufficient EntropyEPSS 1.4%CVE-2021-22727—A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink ParkingEPSS 1.4%CVE-2021-36320HIGHDell Networking X-Series firmware versions prior to 3.0.1.8 contain an authentication bypass vulnerability. A remote unauthenticated attackeEPSS 1.2%CVE-2020-29508MEDIUMDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper InputEPSS 1.1%CVE-2020-36732MEDIUMThe crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the ouEPSS 1.1%CVE-2023-49599CRITICALAn insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially cEPSS 1.0%CVE-2023-26154MEDIUMVersions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alEPSS 1.0%CVE-2023-31176HIGHInsufficient entropy vulnerability could lead to authentication bypassEPSS 0.9%CVE-2022-33738—OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portalEPSS 0.9%CVE-2024-25730CRITICALHitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, EPSS 0.9%CVE-2021-4240LOWphpservermon User.php generatePasswordResetToken predictable algorithm in random number generatorEPSS 0.8%CVE-2026-7210MEDIUMThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protectionEPSS 0.8%CVE-2021-4241LOWphpservermon User.php setUserLoggedIn predictable algorithm in random number generatorEPSS 0.8%CVE-2024-36400CRITICALnano-id is unable to generate the correct character setEPSS 0.8%