834
Because the seed for the PRNG is always the user's ID, the session ID will always be the same. An
attacker could thus predict any user's session ID and potentially hijack the session.
If the user IDs are generated sequentially, or otherwise restricted to a narrow range of values, then
this example also exhibits a Small Seed Space (CWE-339).
Observed Examples
Reference Description
CVE-2022-39218 SDK for JavaScript app builder for serverless code uses the same fixed seed
for a PRNG, allowing cryptography bypass
https://www.cve.org/CVERecord?id=CVE-2022-39218
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 861 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 18 - Miscellaneous (MSC)
844 2370
MemberOf 905 SFP Primary Cluster: Predictability 888 2388
MemberOf 1152 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 49. Miscellaneous (MSC)
1133 2453
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1414 Comprehensive Categorization: Randomness 1400 2543
Notes
Maintenance
As of CWE 4.5, terminology related to randomness, entropy, and predictability can vary widely.
Within the developer and other communities, "randomness" is used heavily. However, within
cryptography, "entropy" is distinct, typically implied as a measurement. There are no commonlyused
definitions, even within standards documents and cryptography papers. Future versions of
CWE will attempt to define these terms and, if necessary, distinguish between them in ways that
are appropriate for different communities but do not reduce the usability of CWE for mapping,
understanding, or other scenarios.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Same Seed in PRNG
The CERT Oracle Secure
Coding Standard for Java
(2011)
MSC02-J Generate strong random numbers
References
[REF-267]Information Technology Laboratory, National Institute of Standards and Technology.
"SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2001 May 5. < https://
csrc.nist.gov/csrc/media/publications/fips/140/2/final/documents/fips1402.pdf >.2023-04-07.
[REF-1192]Information Technology Laboratory, National Institute of Standards and Technology.
"FIPS PUB 140-3: SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES". 2019
March 2. < https://csrc.nist.gov/publications/detail/fips/140/3/final >.
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
CWE Version 4.14
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)