CVE-2024-51478

Katalog CVE

CVSS 9.1 · Critical EPSS 0,37%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada yeswiki. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.

Rincian

Terbit di NVD

31 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3 exploit · advisory vendor
• https://github.com/YesWiki/yeswiki/commit/b5a8f93b87720d5d5f033a4b3a131ce0fb621dbc patch
• https://github.com/YesWiki/yeswiki/commit/e1285709f6f6a2277bd0075acf369f33cefd78f7 patch