PT-2022-20315 · Unknown · Openmoney Api

Published 2022-05-16 · Updated 2022-05-25 · CVE-2022-30782

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Openmoney API versions through 2020-06-29

Description The issue concerns the use of the JavaScript Math.random function, which does not provide cryptographically secure random numbers. This could potentially lead to security risks, as non-secure random numbers can be predictable.

Recommendations For Openmoney API versions through 2020-06-29, consider using a cryptographically secure pseudorandom number generator as a replacement for the Math.random function to mitigate potential security risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2022-30782

Affected Products

Openmoney Api

References · 5

• https://github.com/openmoney/openmoney-api/blob/1b836e5826dfd59145223a8a48e6c45ddb325762/api/helpers/util.helper.js#L6 · Patch
• https://osv.dev/vulnerability/CVE-2022-30782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30782 · Security Note
• https://t.me/cvenotify/30265 · Telegram Post
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/random · Note