CVE-2023-46233

CVE-2023-46233 describes a critical weakness in crypto-js, a JavaScript cryptography library, specifically impacting its PBKDF2 implementation prior to version 4.2.0. The vulnerability stems from its default use of SHA1 and a single iteration, rendering it significantly weaker than industry standards and susceptible to brute-force attacks. This flaw carries a CVSS score of 9.1 (CRITICAL) due to its network-exploitable nature, low attack complexity, and high potential for compromise of confidentiality and integrity, particularly when used for password protection or signature generation. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this vulnerability.