Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-330 (使用不充分的随机数) — Vulnerability Class 112

112 vulnerabilities classified as CWE-330 (使用不充分的随机数). AI Chinese analysis included.

CWE-330 represents a critical weakness where software relies on predictable or insufficiently random values within security-sensitive contexts, such as session token generation or cryptographic key creation. Attackers typically exploit this flaw by analyzing patterns in the generated values to predict future outputs, thereby bypassing authentication mechanisms or hijacking active user sessions. This vulnerability often stems from the misuse of standard pseudo-random number generators that lack cryptographic security properties. To mitigate this risk, developers must employ cryptographically secure pseudo-random number generators (CSPRNGs) that are specifically designed to resist prediction even if previous outputs are known. Additionally, ensuring proper seeding with high-entropy sources and avoiding custom randomization algorithms are essential practices for maintaining the integrity of security-dependent operations.

MITRE CWE Description
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Common Consequences (3)
Confidentiality, OtherOther
When a protection mechanism relies on random values to restrict access to a sensitive resource, such as a session ID or a seed for generating a cryptographic key, then the resource being protected could be accessed by guessing the ID or key.
Access Control, OtherBypass Protection Mechanism, Other
If product relies on unique, unguessable IDs to identify a resource, an attacker might be able to guess an ID for a resource that is owned by another user. The attacker could then read the resource, or pre-create a resource with the same ID to prevent the legitimate program from properly sending the…
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity
When an authorization or authentication mechanism relies on random values to restrict access to restricted functionality, such as a session ID or a seed for generating a cryptographic key, then an attacker may access the restricted functionality by guessing the ID or key.
Mitigations (3)
Architecture and DesignUse a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce…
ImplementationConsider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Architecture and Design, RequirementsUse products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
Examples (2)
This code attempts to generate a unique random identifier for a user's session.
function generateSessionID($userID){ srand($userID); return rand(); }
Bad · PHP
The following code uses a statistical PRNG to create a URL for a receipt that remains active for some period of time after a purchase.
String GenerateReceiptURL(String baseUrl) { Random ranGen = new Random(); ranGen.setSeed((new Date()).getTime()); return(baseUrl + ranGen.nextInt(400000000) + ".html"); }
Bad · Java
CVE IDTitleCVSSSeverityPublished
CVE-2022-25752 多款 Siemens 产品安全特征问题漏洞 — SCALANCE X302-7 EEC (230V) 7.5 -2022-04-12
CVE-2022-29035 JetBrains Ktor Native 安全特征问题漏洞 — Ktor 3.3 Low2022-04-11
CVE-2022-26851 Dell Technologies Dell PowerScale OneFS 安全特征问题漏洞 — PowerScale OneFS 9.1 Critical2022-04-08
CVE-2021-20322 Linux kernel 安全特征问题漏洞 — kernel 7.4 -2022-02-18
CVE-2021-37186 Siemens SIMATIC 安全特征问题漏洞 — LOGO! CMR2020 8.3 -2021-09-14
CVE-2021-23020 NGINX控制器 安全特征问题漏洞 — Nginx Controller 5.5 -2021-06-01
CVE-2020-10729 Red Hat Ansible 安全特征问题漏洞 — Ansible 5.5 -2021-05-27
CVE-2021-29499 Predictable SIF UUID Identifiers — sif 7.5 High2021-05-07
CVE-2021-25677 多款Siemens产品 安全特征问题漏洞 — APOGEE PXC Compact (BACnet) 5.3 Medium2021-04-22
CVE-2021-27393 Nucleus ReadyStart安全特征问题漏洞 — Nucleus NET 5.3 -2021-04-22
CVE-2021-21352 Predictable tokens used for password resets — timetracker 6.8 Medium2021-03-03
CVE-2020-27264 多款Sooil产品安全特征问题漏洞 — SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A 8.8 -2021-01-19
CVE-2020-7548 多款 Schneider Electric 产品安全特征问题漏洞 — Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version information) 8.8 -2020-12-01
CVE-2020-25705 Linux kernel 安全特征问题漏洞 — Siemens Lunux Based Products 7.4 -2020-11-17
CVE-2019-6821 多款Schneider Electric产品安全特征问题漏洞 — Modicon Controllers, Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum 9.4 -2019-05-22
CVE-2019-3795 Insecure Randomness When Using a SecureRandom Instance Constructed by Spring Security — Spring Security 6.5 -2019-04-09
CVE-2018-17888 NUUO CMS 安全漏洞 — NUUO CMS 9.8 -2018-10-12
CVE-2018-13280 Synology DiskStation Manager 安全漏洞 — DiskStation Manager (DSM) 7.4 -2018-07-30
CVE-2017-16028 react-native-meteor-oauth 安全漏洞 — react-native-meteor-oauth node module 7.5 -2018-06-04
CVE-2018-1108 Linux kernel驱动程安全特征问题漏洞 — drivers 6.5 -2018-05-21
CVE-2017-6026 Schneider Electric Modicon PLCs Modicon M241和Modicon M251 安全特征问题漏洞 — Schneider Electric Modicon PLCs 9.1 -2017-06-30
CVE-2017-0897 EllisLab ExpressionEngine 安全漏洞 — ExpressionEngine 7.5 -2017-06-22

Vulnerabilities classified as CWE-330 (使用不充分的随机数) represent 112 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.