The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7248740 advisory.

  - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string 0.
    with an integer, which makes the output more predictable than necessary. (CVE-2020-36732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7244573 advisory.

  - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string 0.
    with an integer, which makes the output more predictable than necessary. (CVE-2020-36732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0."
    with an integer, which makes the output more predictable than necessary. (CVE-2020-36732)

ID	Name	Product	Family	Severity
271280	IBM MQ 9.1 < 9.1.0.32 LTS / 9.2 < 9.2.0.38 LTS / 9.3 < 9.3.0.35 LTS / 9.3 < 9.4.4.0 CD / 9.4 < 9.4.0.16 LTS (7248740)	Nessus	Misc.	medium
264582	IBM WebSphere Application Server Liberty 17.0.0.3 < 25.0.0.10 (7244573)	Nessus	Web Servers	medium
409716	SCA: security update for crypto-js (GHSA-3w3w-pxmm-2w2j)	Tenable Cloud Security	SCA Checks	medium
409716	SCA: security update for crypto-js (GHSA-3w3w-pxmm-2w2j)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2020-36732

medium

Tenable Plugins

medium

medium

medium

medium