Fallos del tipo CWE-331

87 resultados

Entropia Insuficiente

A geração de números aleatórios ou valores criptográficos usa fonte de aleatoriedade fraca (como timestamp, PID ou função pseudoaleatória simples), permitindo que um atacante preveja ou reproduza os valores gerados. Isso compromete a segurança de tokens, chaves, nonces e IDs que deveriam ser imprevisíveis.

Ejemplo

Um sistema gera tokens de sessão usando apenas Math.random() ou concatenando a hora atual com um número sequencial. Um atacante consegue adivinhar tokens válidos de outros usuários porque a origem de aleatoriedade é reproduzível ou tem espaço de busca pequeno.

Cómo mitigar

Use geradores criptográficos recomendados pelo sistema operacional: os.urandom() (Python), crypto.getRandomBytes() (Node.js), SecureRandom (Java) ou /dev/urandom (Linux). Nunca use Math.random(), rand() ou funções baseadas em clock/PID para segurança.

CVE-2017-13992—An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently randoEPSS 3.5%CVE-2022-43755HIGHRancher: Non-random authentication tokenEPSS 1.7%CVE-2025-6931MEDIUMD-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropyEPSS 1.6%CVE-2021-36294CRITICALDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker mayEPSS 1.6%CVE-2020-1773HIGHSession / Password / Password token leakEPSS 1.5%CVE-2022-37401—Apache OpenOffice Weak Master KeysEPSS 1.5%CVE-2012-4687—Post Oak Bluetooth Traffic Systems Insufficient EntropyEPSS 1.4%CVE-2021-22727—A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink ParkingEPSS 1.4%CVE-2021-36320HIGHDell Networking X-Series firmware versions prior to 3.0.1.8 contain an authentication bypass vulnerability. A remote unauthenticated attackeEPSS 1.2%CVE-2020-29508MEDIUMDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper InputEPSS 1.1%CVE-2020-36732MEDIUMThe crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the ouEPSS 1.1%CVE-2023-49599CRITICALAn insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially cEPSS 1.0%CVE-2023-26154MEDIUMVersions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alEPSS 1.0%CVE-2023-31176HIGHInsufficient entropy vulnerability could lead to authentication bypassEPSS 0.9%CVE-2022-33738—OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portalEPSS 0.9%CVE-2024-25730CRITICALHitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, EPSS 0.9%CVE-2021-4240LOWphpservermon User.php generatePasswordResetToken predictable algorithm in random number generatorEPSS 0.8%CVE-2026-7210MEDIUMThe expat and elementtree parsers use insufficient entropy for XML hash-flooding protectionEPSS 0.8%CVE-2021-4241LOWphpservermon User.php setUserLoggedIn predictable algorithm in random number generatorEPSS 0.8%CVE-2024-36400CRITICALnano-id is unable to generate the correct character setEPSS 0.8%