PT-2023-31575 · Unknown+1 · Faye-Websocket.Js+1

Kelsey Tian · Publicado 2023-12-21 · Atualizado 2023-12-29 · CVE-2023-50475

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions bcoin versions 2.2.0

Description An issue was discovered that allows remote attackers to obtain sensitive information via weak hashing algorithms in the component vendorfaye-websocket.js. This issue affects the bsock component.

Recommendations For version 2.2.0, consider disabling the use of weak hashing algorithms in the vendorfaye-websocket.js component until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2023-50475

GHSA-JJ93-39PF-7MCF

Produtos afetados

Bcoin

Faye-Websocket.Js

Referências · 11

• 🔥 https://github.com/bcoin-org/bcoin/issues/1174 · Exploit
• 🔥 https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-50475.md · Exploit
• https://github.com/bcoin-org/bcoin/blob/master/node_modules/bsock/package.json · Nota
• https://github.com/bcoin-org/bcoin · Nota
• https://github.com/bcoin-org/bsock/blob/master/package.json · Nota
• https://osv.dev/vulnerability/CVE-2023-50475 · Aviso do Fabricante
• https://t.me/cvenotify/64635 · Publicação no Telegram
• https://t.me/cvenotify/64651 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-50475 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-jj93-39pf-7mcf · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1737830807358587037 · Publicação no Twitter