Java : Use of a one-way hash with a predictable Salt

One of the attack methods on a password authentication system uses tables of pre-computed hash values of popular passwords. Salt is an arbitrary string, which is fed into the hash function concatenated with the original data (usually a password) in order to prevent such an attack.

The application uses predictable salt as part of the input data, which can jeopardize system security. Since a predictable pseudo-random number generator is used to produce salt, the attacker may know the value of the salt.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.