CVE-2021-23451: Use of Insufficiently Random Values

July 26, 2022 (updated August 6, 2022)

The package otp-generator before 3.0.0 is vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.

References

github.com/Maheshkumar-Kakade/otp-generator/commit/b27de1ce439ae7f533cec26677e9698671275b70
github.com/Maheshkumar-Kakade/otp-generator/issues/12
github.com/advisories/GHSA-6x93-h9g3-9phr
nvd.nist.gov/vuln/detail/CVE-2021-23451
security.snyk.io/vuln/SNYK-JS-OTPGENERATOR-1655480

Code Behaviors & Features

Detect and mitigate CVE-2021-23451 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →