CVE-2017-16028
04.06.2018, 19:29
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
| Vendor | Product | Version |
|---|---|---|
| randomatic_project | randomatic | 𝑥 < 3.0.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-330 - Use of Insufficiently Random ValuesThe software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
References