The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string 0.
    with an integer, which makes the output more predictable than necessary. (CVE-2020-36732)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7248740 advisory.

  - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string 0.
    with an integer, which makes the output more predictable than necessary. (CVE-2020-36732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7244573 advisory.

  - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string 0.
    with an integer, which makes the output more predictable than necessary. (CVE-2020-36732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0."
    with an integer, which makes the output more predictable than necessary. (CVE-2020-36732)

ID	Name	Product	Family	Type	Severity
333380	Linux Distros Unpatched Vulnerability : CVE-2020-36732	Nessus	Misc.	Local	medium
271280	IBM MQ 9.1 < 9.1.0.32 LTS / 9.2 < 9.2.0.38 LTS / 9.3 < 9.3.0.35 LTS / 9.3 < 9.4.4.0 CD / 9.4 < 9.4.0.16 LTS (7248740)	Nessus	Misc.	Local	medium
264582	IBM WebSphere Application Server Liberty 17.0.0.3 < 25.0.0.10 (7244573)	Nessus	Web Servers	Remote	medium
409716	SCA: security update for crypto-js (GHSA-3w3w-pxmm-2w2j)	Tenable Cloud Security	SCA Checks	Local	medium
409716	SCA: security update for crypto-js (GHSA-3w3w-pxmm-2w2j)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2020-36732

medium

Tenable Plugins

medium

medium

medium

medium

medium