CVE-2023-40173highCWE-522

CVE-2023-40173: high-severity vulnerability in fobybus social-media-skeleton

Unsalted passwords in fobybus/social-media-skeleton

Published · Updated

Follow this CVE+ Monitor social-media-skeleton

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
fobybus · social-media-skeleton
Related CVEs — fobybus social-media-skeleton

In the same product, most dangerous first.

CVE-2023-39344CRITICALsocial-media-skeleton vulnerable to Pre-Auth SQLi leading to RCEEPSS 1.5%CVE-2023-40174MEDIUMInsufficient Session Expiration in fobybus/social-media-skeletonEPSS 0.5%CVE-2023-39518MEDIUMsocial-media-skeleton stored Cross-site Scripting vulnerabilityEPSS 0.5%CVE-2023-40172MEDIUMCross-Site Request Forgery (CSRF) in fobybus/social-media-skeletonEPSS 0.3%