CVE-2023-40173highCWE-522

CVE-2023-40173: fallo de gravedad alta en fobybus social-media-skeleton

Unsalted passwords in fobybus/social-media-skeleton

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear social-media-skeleton

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.7%
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
fobybus · social-media-skeleton
CVEs relacionadas — fobybus social-media-skeleton

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-39344CRITICALsocial-media-skeleton vulnerable to Pre-Auth SQLi leading to RCEEPSS 1.5%CVE-2023-40174MEDIUMInsufficient Session Expiration in fobybus/social-media-skeletonEPSS 0.5%CVE-2023-39518MEDIUMsocial-media-skeleton stored Cross-site Scripting vulnerabilityEPSS 0.5%CVE-2023-40172MEDIUMCross-Site Request Forgery (CSRF) in fobybus/social-media-skeletonEPSS 0.3%