CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

Score

CVSS 3.1 5.3 Medium

Status

Modified - cve@mitre.org

Published

2023-06-12

Last modified

2025-01-06

Weaknesses

CWE-330, CWE-331

Affected products

• Crypto-js (Crypto-js Project)

References

• https://github.com/brix/crypto-js/compare/3.2.0...3.2.1
• https://github.com/brix/crypto-js/issues/254
• https://github.com/brix/crypto-js/issues/256
• https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b
• https://security.netapp.com/advisory/ntap-20230706-0003/
• https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472