265 – Insecure encryption algorithm - AES
Description
The source code uses RSA/ECB/PKCS1Padding and AES/CBC/PKCS5PADDING encryption and other references use CTR or CFB which are considered insecure.
Impact
Decrypt the information encrypted with the algorithm because it has vulnerabilities that make it easily breakable.
Recommendation
Only secure encryption with secure algorithms such as RSA/NONE/OAEPwithSHA-256andMGF1Padding or use implementations with the GCM mode encryption algorithm.
Threat
Attacker with access to the code.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: L
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: P