An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with CryptoJS.lib.WordArray.random() in newer versions, which uses math.random() internally. This is not cryptographically strong.
Threat-Mapped Scoring
Score: 0.0
Priority: Unclassified
EPSS
Score: 0.0014 Percentile:
0.34852
CVSS Scoring
CVSS v3.0 Score: 7.5
Severity: HIGH
Mapped CWE(s)
CWE-327
: Use of a Broken or Risky Cryptographic Algorithm
All CAPEC(s)
CAPEC-20: Encryption Brute Forcing
CAPEC-459: Creating a Rogue Certification Authority Certificate
CAPEC-473: Signature Spoof
CAPEC-475: Signature Spoofing by Improper Validation