Description
Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.
Recommendation
Update the simple-crypto-js package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.3.0
- Patched version(s): 2.3.0
References
Could your website be exposed too?
SmartScanner can check your website for Insecure Cryptography Algorithm in simple-crypto-js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Insecure Cryptography Algorithm in parsel - Vulnerability
- @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys - Vulnerability
- Insecure Default Configuration in tesseract.js - Vulnerability
- Svelte: SSR XSS via Insecure Promise Serialization in hydratable - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated April 17, 2023