CWE-331βInsufficient Entropy
PUBLISHEDweakness record
released 2006-07-19 Β· last modified 2025-12-11
Metadata
- CWE ID:
- CWE-331
- Abstraction:
- Base
- Structure:
- Simple
- Status:
- Draft
- Release Date:
- 2006-07-19
- Latest Modification Date:
- 2025-12-11
Weakness Name
Insufficient Entropy
Description
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Common Consequences
- Scope:
- Access Control, Other
- Impact:
- Bypass Protection Mechanism, Other
- Notes:
- An attacker could guess the random numbers generated and could gain unauthorized access to a system if the random numbers are used for authentication and authorization.