MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2020-36732

CVSS 5.3v3.1pub. 2023-06-12upd. 2025-01-06

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Crypto Js Project Crypto Js

    APP
    Crypto-Js Project
    < 3.2.1
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2023-46233CRITICAL9.1ten sam produkt

crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times...