PT-2023-11874 · Crypto-Js · Crypto-Js

Kangyunu · Published 2023-06-12 · Updated 2025-09-10 · CVE-2020-36732

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions crypto-js versions prior to 3.2.1

Description The issue concerns the generation of random numbers in the crypto-js package. Specifically, it concatenates the string "0." with an integer, making the output more predictable than necessary.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

CWE-331

Related Identifiers

CVE-2020-36732

GHSA-3W3W-PXMM-2W2J

Affected Products

Crypto-Js

References · 17

• https://github.com/brix/crypto-js/issues/254 · Vendor Advisory
• https://github.com/brix/crypto-js/issues/256 · Vendor Advisory
• https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36732 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36732 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3w3w-pxmm-2w2j · Vendor Advisory
• https://github.com/brix/crypto-js/commit/b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5 · Note
• https://github.com/brix/crypto-js/compare/3.2.0...3.2.1 · Note
• https://github.com/brix/crypto-js/commit/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b · Note
• https://github.com/brix/crypto-js · Note
• https://t.me/cvenotify/53818 · Telegram Post
• https://t.me/cvenotify/106420 · Telegram Post
• https://t.me/cvenotify/52148 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472 · Note
• https://twitter.com/knaepp/status/1965884245743677802 · Twitter Post