Home / Vulnerability Database / PL or SQL : Hardcoded initialization vector
PL/SQL
PL or SQL : Hardcoded initialization vector
Classification
OWASP Top 10 2013
OWASP Top 10 2017
OWASP Top 10 2021
OWASP MASVS
HIPAA
CWE/SANS Top 25 2011
Overview
The application performs encryption with hardcoded initialization vector (IV). In case of encrypting related messages with the same key and hardcoded IV an attacker can obtain information about the message. For secure encryption it is necessary for the IV to be cryptographically pseudorandom, that is, unpredictable to an attacker.
Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.
References
- CWE-329: Not Using a Random IV with CBC Mode
- Initialization vector - Wikipedia
- Forced into using a static IV (AES) - security.stackexchange.com
- Why should I use an Initialization Vector (IV) when I have unique keys? - crypto.stackexchange.com
- OWASP Top 10 2017-A3-Sensitive Data Exposure
- CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
- CWE-798: Use of Hard-coded Credentials
MEDIUM
DerScanner Severity Score
Do you want to fix PL or SQL : Hardcoded initialization vector in your application?
See also
PL/SQL
PL or SQL : Open redirect
PL/SQL
PL or SQL : Cross-site scripting (XSS)
PL/SQL