The initialization vector (IV) is explicitly set in the application configuration file. In case of encrypting related messages with the same key and hardcoded IV an attacker can obtain information about the message. For secure encryption it is necessary for the IV to be cryptographically pseudorandom, that is, unpredictable to an attacker.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

CRITICAL

Config files : Initialization vector in configuration file

Classification

Overview

References

DerScanner Severity Score

Do you want to fix Config files : Initialization vector in configuration file in your application?

See also

Config files : Text4Shell Vulnerability

Config files : Incorrect directory deletion

Config files : Code injection