Generation of Predictable IV with CBC Mode
| Property | |
|---|---|
| Language | java |
| Severity |  |
| CWE | CWE-329: Generation of Predictable IV with CBC Mode |
| OWASP | A02:2021 - Cryptographic Failures |
| Confidence Level | High |
| Impact Level | Medium |
| Likelihood Level | Medium |
Description#
The code uses a fixed or hardcoded initialization vector (IV) for block cipher encryption instead of generating a new random IV for each operation. This means identical plaintexts will always produce identical ciphertexts, reducing encryption effectiveness.
Impact#
Attackers could detect patterns in encrypted data, allowing them to infer sensitive information or potentially decrypt messages. This weakens overall data confidentiality and can expose user data, violating security standards and putting both users and the organization at risk.