CVE-2024-51478

Published: Oct 31, 2024Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.

Affected (1)

Products: Yeswiki: Yeswiki

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Yeswiki Yeswiki	Before 4.4.5

Related CWEs

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

References (3)

https://github.com/YesWiki/yeswiki/commit/b5a8f93b87720d5d5f033a4b3a131ce0fb621dbc

Source: security-advisories@github.com

Patch

https://github.com/YesWiki/yeswiki/commit/e1285709f6f6a2277bd0075acf369f33cefd78f7

Source: security-advisories@github.com

Patch

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.