Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
References
| Link | Resource |
|---|---|
| https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 | Issue Tracking Patch Third Party Advisory |
| https://github.com/socketio/socket.io/issues/856 | Issue Tracking Third Party Advisory |
| https://github.com/socketio/socket.io/pull/857 | Issue Tracking Third Party Advisory |
| https://nodesecurity.io/advisories/321 | Third Party Advisory |
| https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 | Issue Tracking Patch Third Party Advisory |
| https://github.com/socketio/socket.io/issues/856 | Issue Tracking Third Party Advisory |
| https://github.com/socketio/socket.io/pull/857 | Issue Tracking Third Party Advisory |
| https://nodesecurity.io/advisories/321 | Third Party Advisory |
Configurations
History
21 Nov 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8 - Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/socketio/socket.io/issues/856 - Issue Tracking, Third Party Advisory | |
| References | () https://github.com/socketio/socket.io/pull/857 - Issue Tracking, Third Party Advisory | |
| References | () https://nodesecurity.io/advisories/321 - Third Party Advisory |
Information
Published : 2018-06-04 19:29
Updated : 2024-11-21 03:15
NVD link : CVE-2017-16031
Mitre link : CVE-2017-16031
CVE.ORG link : CVE-2017-16031
JSON object : View
Products Affected
socket
- socket.io
CWE
CWE-330
Use of Insufficiently Random Values