395 – Insecure generation of random numbers - Static IV
Description
The application uses static, hardcoded values for initialization vectors. By knowing initialization vectors an attacker could perform a reverse engineering attack to predict the random values that should remain as secrets.
Impact
Predict random values to craft new attack vectors.
Recommendation
Generate initialization vectors randomly using mechanisms with secure randomness and high entropy.
Threat
Authenticated attacker from the Internet with access to the source code.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: H
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: P