CVE-2024-52322
EUVD-2024-5436605.04.2025, 17:15
WebService::Xero 0.11 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Specifically WebService::Xero uses the Data::Random library which specifically states that it is "Useful mostly for test programs". Data::Random uses the rand() function.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| localshop | webservice\ | 𝑥 ≤ 0.11 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-331 - Insufficient EntropyThe software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.