Generation of Predictable IV with CBC Mode
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-329: Generation of Predictable IV with CBC Mode |
| OWASP | A02:2021 - Cryptographic Failures |
| Confidence Level | High |
| Impact Level | Medium |
| Likelihood Level | High |
Description#
The code uses a static (hardcoded) initialization vector (IV) with AES encryption in CBC mode. This makes the encrypted data predictable and vulnerable to certain attacks, as the same IV is reused for multiple encryptions.
Impact#
An attacker could exploit this to uncover patterns in the encrypted data or conduct chosen-plaintext attacks, potentially leading to sensitive information being exposed even if the encryption key remains secret. This weakens the overall security of the application and puts user data at risk.