845
This example also exhibits a Small Seed Space (CWE-339).
Observed Examples
Reference Description
CVE-2002-0389 Mail server stores private mail messages with predictable filenames in a worldexecutable
directory, which allows local users to read private mailing list
archives.
https://www.cve.org/CVERecord?id=CVE-2002-0389
CVE-2001-1141 PRNG allows attackers to use the output of small PRNG requests to determine
the internal state information, which could be used by attackers to predict
future pseudo-random numbers.
https://www.cve.org/CVERecord?id=CVE-2001-1141
CVE-2000-0335 DNS resolver library uses predictable IDs, which allows a local attacker to
spoof DNS query results.
https://www.cve.org/CVERecord?id=CVE-2000-0335
CVE-2005-1636 MFV. predictable filename and insecure permissions allows file modification to
execute SQL queries.
https://www.cve.org/CVERecord?id=CVE-2005-1636
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 905 SFP Primary Cluster: Predictability 888 2388
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Notes
Maintenance
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Predictable from Observable State
References
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-342: Predictable Exact Value from Previous Values
Weakness ID : 342
CWE Version 4.14
CWE-342: Predictable Exact Value from Previous Values
CWE-342: Predictable Exact Value from Previous Values