PT-2023-27305 · Unknown · Social Media Skeleton

Zodiac0704 · Publicado 2023-08-18 · Atualizado 2023-08-23 · CVE-2023-40173

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Social media skeleton versions prior to 1.0.5

Description The issue concerns a social media project implemented using php, css, javascript, and html. Prior to version 1.0.5, the project did not properly salt passwords, leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5.

Recommendations For versions prior to 1.0.5, upgrade to version 1.0.5 to address the issue. As a temporary workaround, consider implementing additional security measures to protect user passwords until the upgrade can be applied.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2023-40173

GHSA-RFMV-7M7G-V628

Produtos afetados

Social Media Skeleton

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40173.json · Exploit
• https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848 · Correção
• https://github.com/fobybus/social-media-skeleton/commit/df31da44ffed3ea065cbbadc3c8052d0d489a2ef · Correção
• https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-rfmv-7m7g-v628 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-40173 · Nota de Segurança
• https://t.me/cvenotify/56897 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1692700138962084141 · Publicação no Twitter
• https://t.me/cibsecurity/68852 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-40173 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1692661098070032686 · Publicação no Twitter