Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-51478

Date: October 31, 2024

YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.

Language: PHP

Severity Score

Related Resources (6)

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3
https://github.com/YesWiki/yeswiki/commit/b5a8f93b87720d5d5f033a4b3a131ce0fb621dbc
https://nvd.nist.gov/vuln/detail/CVE-2024-51478
https://github.com/YesWiki/yeswiki/commit/e1285709f6f6a2277bd0075acf369f33cefd78f7
https://github.com/YesWiki/yeswiki
https://www.mend.io/vulnerability-database/CVE-2024-51478

Severity Score

Weakness Type (CWE)

Use of a Broken or Risky Cryptographic Algorithm

CWE-327

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us