Insecure Cryptography

2024-05-0309:32:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

insecure cryptography

elixir

blowfish

initialization vector

database vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

60.8%

JSON

elixir is vulnerable to Insecure Cryptography. The vulnerability is due to Elixir’s implementation of Blowfish in CFB mode without generating a unique initialization vector (IV) for each encryption operation, which allows context-dependent users to obtain sensitive information and decrypt the database.