What is CVE-2017-11133?

CVE-2017-11133 is a high-severity vulnerability in Stashcat Heinekingmedia, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 7.5/10. Published 2017-08-01.

How severe is CVE-2017-11133?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Stashcat Heinekingmedia

CVE-2017-11133

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with CryptoJS.lib.WordArray.random() in newer versions, which uses math.random() internally. This is not cryptographically strong.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.007 (48.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Stashcat Heinekingmedia
N/a — versions n/a

Weakness classification (CWE)

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm

References

cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-11133?: CVE-2017-11133 is a high-severity vulnerability in Stashcat Heinekingmedia, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 7.5/10. Published 2017-08-01.
How severe is CVE-2017-11133?: High severity. CVSS v3 base score is 7.5 out of 10.