CVE-2023-40173 HIGH

CVE-2023-40173: Unsalted passwords in fobybus/social-media-skeleton

Vendor Fobybus
Product social-media-skeleton
Weakness CWE-522 · Insufficiently protected credentials
Published August 18, 2023
Last update October 2, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

August 18, 2023 CVE published
October 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2019-5648 LDAP Credential Exposure in Barracuda Load Balancer ADC CVE-2022-23725 PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstances CVE-2026-32171 Azure Logic Apps Elevation of Privilege Vulnerability CVE-2026-27027 Everon api.everon.io Insufficiently Protected Credentials CVE-2024-23551 HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint