Fallos del tipo CWE-327

401 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2023-28053MEDIUM Dell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated cryptographic algorithms in the SSH component. A remotEPSS 0.4%CVE-2023-4326—Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuitesEPSS 0.4%CVE-2026-76133CRITICALEbyte NA111-M Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.4%CVE-2021-38933MEDIUMIBM Sterling Connect:Express for UNIX information disclosureEPSS 0.4%CVE-2023-26276MEDIUMIBM QRadar information disclosureEPSS 0.4%CVE-2022-34361MEDIUMIBM Sterling Secure Proxy information disclosureEPSS 0.4%CVE-2023-38730MEDIUMIBM Spectrum Copy Data Management information disclosureEPSS 0.4%CVE-2023-51839CRITICALDeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.EPSS 0.4%CVE-2024-51478CRITICALUse of a Broken or Risky Cryptographic Algorithm in YesWikiEPSS 0.4%CVE-2024-10128MEDIUMTopdata Inner Rep Plus WebServer td.js.gz risky encryptionEPSS 0.4%CVE-2021-46900HIGHSympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an EPSS 0.4%CVE-2023-27557MEDIUMIBM Safter Payments information disclosureEPSS 0.4%CVE-2023-47640MEDIUMInsecure Use of HMAC-SHA1 For Session Signing in datahubEPSS 0.4%CVE-2023-23040HIGHTP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication.EPSS 0.4%CVE-2022-43949MEDIUMA use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker toEPSS 0.4%CVE-2026-2618MEDIUMBeetel 777VR1 SSH Service risky encryptionEPSS 0.4%CVE-2025-3200CRITICALCom-Server Exposed via Weak TLSEPSS 0.4%CVE-2023-4331—Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocolsEPSS 0.4%CVE-2024-55885MEDIUMBeego Vulnerable to Collision Hazards of MD5 in Cache Key FilenamesEPSS 0.3%CVE-2020-8911MEDIUMCBC padding oracle in AWS S3 Crypto SDK for GoLangEPSS 0.3%