CVE-2017-16028

Medium

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a…

hackerone·CWE-330·Published 2018-06-04

CVSS

5.3

EPSS

0.01

KEV

Exploits

cve.orgen

185 chars

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

NVDen

185 chars

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

Affected versions of `randomatic` generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended. ## Recommendation Update to version 3.0.0 or later.

GHSAen

252 chars

NVDes

211 chars

react-native-meteor-oauth es una biblioteca para iniciar sesión mediante Oauth2 en un servidor Meteor en React Native. El token aleatorio oauth se genera mediante un RNG débil criptográficamente (Math.random()).

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.0	10.0	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
3.0	Primary	NVD	5.3	3.9	1.4	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
3.1	Secondary	GHSA	5.3	—	—	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N