Weaknesses of type CWE-337

13 results

Semente previsível em gerador de números pseudoaleatórios

Ocorre quando um PRNG é inicializado com uma semente determinística ou facilmente adivinhável (como timestamp do sistema, PID do processo, ou valor fixo em código). Isso torna a sequência de números 'aleatórios' reproduzível, comprometendo criptografia, tokens de sessão e qualquer mecanismo que dependa de aleatoriedade.

Example

Um sistema gera tokens de reset de senha usando Math.random() com semente derivada apenas do horário atual. Um atacante, sabendo quando o token foi gerado (±alguns segundos), consegue gerar a mesma sequência e falsificar o token.

How to mitigate

Use /dev/urandom (Linux), SecureRandom (Java), secrets.SystemRandom (Python 3) ou bibliotecas criptográficas que já abstraem a entropia do SO. Nunca faça semente manual com timestamp, PID ou dados públicos; deixe o sistema operacional fornecer a entropia.

CVE-2022-26852HIGHDell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attackerEPSS 1.2%CVE-2022-40267MEDIUMAuthentication Bypass Vulnerability in Web Server Function on MELSEC SeriesEPSS 1.2%CVE-2026-26018HIGHCoreDNS Loop Detection Denial of Service VulnerabilityEPSS 1.1%CVE-2020-28597CRITICALA predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possEPSS 1.0%CVE-2016-15006LOWenigmaX Scrambling Table main.c getSeed prng seedEPSS 0.8%CVE-2024-7558HIGHJUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unpriEPSS 0.5%CVE-2025-7770HIGHPredictable Seed in Pseudo-Random Number Generator (PRNG) in Tigo Energy Cloud Connect AdvancedEPSS 0.5%CVE-2024-22194LOWcdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration codeEPSS 0.4%CVE-2023-49343MEDIUMTemporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is EPSS 0.3%CVE-2025-55069HIGHAutomationDirect CLICK PLUS Predictable Seed in Pseudo-Random Number GeneratorEPSS 0.3%CVE-2026-25235HIGHPEAR Has a Predictable Verification Hash in Election Account RequestsEPSS 0.3%CVE-2025-62710MEDIUMSakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImplEPSS 0.2%CVE-2025-20613LOWPredictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potentialEPSS 0.1%