842
[REF-1192]Information Technology Laboratory, National Institute of Standards and Technology.
"FIPS PUB 140-3: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2019
March 2. < https://csrc.nist.gov/publications/detail/fips/140/3/final >.
CWE-340: Generation of Predictable Numbers or Identifiers
Weakness ID : 340
Structure : Simple
Abstraction : Class
Description
The product uses a scheme that generates numbers or identifiers that are more predictable than
required.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 330 Use of Insufficiently Random Values 814
ParentOf 341 Predictable from Observable State 843
ParentOf 342 Predictable Exact Value from Previous Values 845
ParentOf 343 Predictable Value Range from Previous Values 847
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Demonstrative Examples
Example 1:
This code generates a unique random identifier for a user's session.
Example Language: PHP (Bad)
function generateSessionID($userID){
srand($userID);
return rand();
}
Because the seed for the PRNG is always the user's ID, the session ID will always be the same. An
attacker could thus predict any user's session ID and potentially hijack the session.
This example also exhibits a Small Seed Space (CWE-339).
Observed Examples
Reference Description
CVE-2022-29330 Product for administering PBX systems uses predictable identifiers and
timestamps for filenames (CWE-340) which allows attackers to access files via
direct request (CWE-425).
https://www.cve.org/CVERecord?id=CVE-2022-29330
CWE Version 4.14
CWE-341: Predictable from Observable State
CWE-341: Predictable from Observable State