PT-2018-6061 · Socket.Io · Socket.Io

Publicado 2018-06-04 · Atualizado 2018-11-07 · CVE-2017-16031

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: socket.io versions 0.9.6 and earlier

Description: The issue concerns the predictability of socket IDs in socket.io, which are generated using Math.random(). This predictability allows an attacker to guess the socket ID, potentially gaining unauthorized access to socket.io servers and obtaining sensitive information.

Recommendations: Update to v0.9.7 or later.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2017-16031

GHSA-QV2V-M59F-V5FW

Produtos afetados

Socket.Io

Referências · 10

• https://github.com/socketio/socket.io · Nota
• https://github.com/socketio/socket.io/issues/856 · Nota
• https://github.com/socketio/socket.io/pull/857 · Nota
• https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 · Correção
• https://osv.dev/vulnerability/CVE-2017-16031 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16031 · Nota de Segurança
• https://nodesecurity.io/advisories/321 · Nota
• https://npmjs.com/advisories/321 · Nota
• https://github.com/advisories/GHSA-qv2v-m59f-v5fw · Nota
• https://osv.dev/vulnerability/GHSA-qv2v-m59f-v5fw · Aviso do Fabricante