CVE-2018-1000620 @ Npm-cryptiles-0.2.2

[RobertMickleCx]

Vulnerable Package issue exists @ Npm-cryptiles-0.2.2 in branch master

Eran Hammer cryptiles version up to 3.1.2 and 4.0.0 - 4.1.1 contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method, that can result in an attacker more likely to be able to brute force something that was supposed to be random.

Namespace: RobertMickleCx
Repository: NodeGoat
Repository Url: https://github.com/RobertMickleCx/NodeGoat
CxAST-Project: RobertMickleCx/NodeGoat
CxAST platform scan: 3f4864fd-127b-412c-8cca-4b4873ce2f29
Branch: master
Application: NodeGoat
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-331

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: HIGH
Availability impact: HIGH

---

References
Commit
Advisory
Advisory
Advisory