← Back

CVE-2017-11133

nvd nist
Published: Aug 1, 2017Modified: May 13, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with CryptoJS.lib.WordArray.random() in newer versions, which uses math.random() internally. This is not cryptographically strong.

Affected (3)

Stashcat
1 product
Heinekingmedia
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Heinekingmedia
Up to 1.7.5
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Heinekingmedia
Up to 0.0.80w
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Heinekingmedia
Up to 0.0.86w

Related CWEs

CWE-327
Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.

References (2)

Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory

Timeline

No history available yet.