CVE-2020-36732

Published: Jun 12, 2023Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

Affected (1)

Products: Crypto Js Project: Crypto Js

Crypto Js Project

1 product

Crypto Js

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Crypto Js Project Crypto Js	Before 3.2.1

Related CWEs

CWE-330

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

CWE-331

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (12)

https://github.com/brix/crypto-js/compare/3.2.0...3.2.1

Source: cve@mitre.org

Release Notes

https://github.com/brix/crypto-js/issues/254

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://github.com/brix/crypto-js/issues/256

Source: cve@mitre.org

Issue TrackingPatchVendor Advisory

https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b

Source: cve@mitre.org

Patch

https://security.netapp.com/advisory/ntap-20230706-0003/

Source: cve@mitre.org

https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472

Source: cve@mitre.org

Third Party Advisory

https://github.com/brix/crypto-js/compare/3.2.0...3.2.1