CWE-334: Small Space of Random Values
Description
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access ControlOther
Bypass Protection Mechanism; Other
An attacker could easily guess the values used. This could lead to unauthorized access to a system if the seed is used for authentication and authorization.
Potential mitigations
- Architecture and DesignRequirementsLibraries or Frameworks
Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).
Related weaknesses
Parent weaknesses
Child weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.